Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.3
PowerLine Runs Without Authentication by Default, Exposing Credentials
published 7 months ago
Summary
PowerLine, a tool for managing Grackle servers, can run without requiring a password or authentication, allowing unauthorized access to sensitive information. This is a critical risk if PowerLine is exposed on a network. To protect your system, always provide a token when starting PowerLine or set the GRACKLE_POWERLINE_TOKEN environment variable, or use the --no-auth flag to intentionally disable authentication.
What to do
- Update grackle-ai powerline to version 0.70.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| npm | grackle-ai | powerline |
<= 0.70.0 Fix: upgrade to 0.70.1
|
Original advisory text
@grackle-ai/powerline Runs Without Authentication by Default
### Impact
When `--token` is not provided and `GRACKLE_POWERLINE_TOKEN` is not set, the PowerLine gRPC server runs with **zero authentication**. A warning is logged (`"NO AUTH (development only)"`) but nothing prevents deployment in this state. Any client that can reach the PowerLine port can spawn agent sessions, access credential tokens, and execute code.
The default binding is `127.0.0.1` (loopback only), which limits exposure to the local machine. However, if PowerLine is accidentally exposed on a network (e.g., in a container or via port forwarding), the impact is critical.
**Affected code:**
- `packages/powerline/src/index.ts:46` — token defaults to empty string
- `packages/powerline/src/index.ts:63-76` — auth interceptor is only added when token is truthy
### Patches
0.70.1
**Fix:** Require an explicit `--no-auth` flag to run without authentication, rather than defaulting to no auth when the token is empty. Throw an error if starting without a token and without `--no-auth`.
### Workarounds
Always provide `--token` or set `GRACKLE_POWERLINE_TOKEN` when starting PowerLine. The Grackle server does this automatically when managing PowerLine lifecycle.
### Resources
- CWE-306: Missing Authentication for Critical Function
- File: `packages/powerline/src/index.ts`
When `--token` is not provided and `GRACKLE_POWERLINE_TOKEN` is not set, the PowerLine gRPC server runs with **zero authentication**. A warning is logged (`"NO AUTH (development only)"`) but nothing prevents deployment in this state. Any client that can reach the PowerLine port can spawn agent sessions, access credential tokens, and execute code.
The default binding is `127.0.0.1` (loopback only), which limits exposure to the local machine. However, if PowerLine is accidentally exposed on a network (e.g., in a container or via port forwarding), the impact is critical.
**Affected code:**
- `packages/powerline/src/index.ts:46` — token defaults to empty string
- `packages/powerline/src/index.ts:63-76` — auth interceptor is only added when token is truthy
### Patches
0.70.1
**Fix:** Require an explicit `--no-auth` flag to run without authentication, rather than defaulting to no auth when the token is empty. Throw an error if starting without a token and without `--no-auth`.
### Workarounds
Always provide `--token` or set `GRACKLE_POWERLINE_TOKEN` when starting PowerLine. The Grackle server does this automatically when managing PowerLine lifecycle.
### Resources
- CWE-306: Missing Authentication for Critical Function
- File: `packages/powerline/src/index.ts`
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-306Missing Authentication for Critical Function
Timeline
Published25 Mar 2026
Updated25 Mar 2026
First seen25 Mar 2026
Sources
GHSA-xq7h-vwjp-5vrh · GHSA
Track software like this
Free during beta