abilityai/trinity vulnerabilities

Latest abilityai/trinity CVEs

Newest publication first

1. CVE-2026-108756 Abilityai Trinity through 0.9.5 Missing Authorization in Telegram Binding Routes

   Published 2026-10-11

   Medium·CVSS 5.3 EPSS 0.22%

   Abilityai Trinity through 0.9.5 contains a missing authorization vulnerability in the Telegram router that allows agent-scoped MCP API keys to perform human-only binding operations. Attackers controlling an agent, typically via prompt injection, can send messages through the owne...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.