Evidence · DiggingBeagle record
Trinity agent API key Telegram-route authorization CVE-2026-108756
GitHub advisory database recording agent-scoped credential authority over owner Telegram binding routes in Trinity through 0.9.5.
- Published
- Oct 11, 2026
- Source role
- secondary reporting
Evidence record
GitHub advisory database recording agent-scoped credential authority over owner Telegram binding routes in Trinity through 0.9.5.
Claim-level citations (2)
- supportsTrinity agent credentials could reach Telegram binding controls reserved for owners: The GitHub advisory database reports that Trinity through 0.9.5 permits agent-scoped API credentials to perform Telegram owner binding actions due to missing route authorization.
Description and linked telegram.py references
- supportsTrinity agent credentials could reach Telegram binding controls reserved for owners: As of the inspected advisory, both affected-version metadata and patched-version metadata are not enumerated as a verified package release.
Package; Affected versions; Patched versions