HIGHnpm
GHSA-647h-p824-99w7@grackle-ai/mcp has a workspace authorization bypass in its knowledge_search MCP tool
Modified: 3/25/2026
package
npm/@grackle-ai/mcp
pkg:npm/%40grackle-ai/mcp
HIGHnpm
GHSA-f9ff-5x35-7gfwGrackle: Fail-open authorization in the MCP tool layer lets scoped agents perform cross-task and cross-session mutations (IDOR)
Modified: 9/10/2026