CVE-2026-108756 Abilityai Trinity through 0.9.5 Missing Authorization in Telegram Binding Routes

Abilityai Trinity through 0.9.5 contains a missing authorization vulnerability in the Telegram router that allows agent-scoped MCP API keys to perform human-only binding operations. Attackers controlling an agent, typically via prompt injection, can send messages through the owner's bot token,...

CVE-2026-108756

The Abilityai Trinity software (versions through 0.9.5 ) contains a missing authorization vulnerability within the Telegram router . This flaw allows agent-scoped MCP API keys to execute operations restricted to human users, specifically binding operations . An attacker who gains control of an ag...