PT-2026-25377 · Unknown · Anything-Llm

Luz-Oasis · Publicado 2026-03-13 · Atualizado 2026-03-17 · CVE-2026-32617

Positive Technologies (AI Summary)

CVSS v2.0

7.6

Alta

Vetor base

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions AnythingLLM versions 1.11.1 and earlier

Description AnythingLLM is an application designed to provide context for Large Language Models (LLMs). On default installations without a configured password or API key, all HTTP endpoints and the agent WebSocket are accessible without authentication. The server’s Cross-Origin Resource Sharing (CORS) policy allows requests from any origin. The application, by default, binds to the loopback address 127.0.0.1. Exploitation is limited to the local network (LAN) due to browser-level security features that prevent public websites from accessing local IP addresses. The application’s functionality involves turning content into context for LLMs during chat interactions.

Recommendations Versions prior to 1.11.1 should be updated. Configure a strong password or API key for the application. Review and restrict the CORS policy to only allow requests from trusted origins.

Exploit

Correção

Enumeração de Fraquezas

CWE-942

CWE-1188

Identificadores relacionados

BDU:2026-04256

CVE-2026-32617

GHSA-24QJ-PW4H-3JMM

Produtos afetados

Anything-Llm

Referências · 7

• 🔥 https://github.com/Mintplex-Labs/anything-llm/security/advisories/GHSA-24qj-pw4h-3jmm · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32617.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-32617 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-32617 · Nota de Segurança
• https://bdu.fstec.ru/vul/2026-04256 · Nota de Segurança
• https://twitter.com/RedPacketSec/status/2033699681851621884 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2032605872275198058 · Publicação no Twitter