PT-2026-56255 · Topoteretes · Cognee

Yu Sun · Publicado 2026-07-07 · Atualizado 2026-07-07 · CVE-2026-58473

Mitre

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Cognee before 1.2.0 contains an improper access control vulnerability that allows unauthenticated attackers to overwrite the global LLM provider configuration by self-registering an account and calling the settings endpoint, which performs no admin or superuser check. Attackers can redirect all LLM operations instance-wide to an attacker-controlled endpoint by exploiting the process-wide singleton configuration cache, enabling exfiltration of prompts, uploaded documents, extracted entities, and knowledge graph content from all users.

Exploit

Correção

Missing Authorization

Missing Authentication

Enumeração de Fraquezas

CWE-862

CWE-306

Identificadores relacionados

CVE-2026-58473

Produtos afetados

Cognee

Referências · 5

• 🔥 https://github.com/topoteretes/cognee/issues/3084 · Exploit
• https://github.com/topoteretes/cognee/commit/d10b1b77e2157c6238fd4d1acb1923a048991699 · Correção
• https://github.com/topoteretes/cognee/releases/tag/v1.2.0 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-58473 · Nota de Segurança
• https://vulncheck.com/advisories/cognee-unauthorized-llm-configuration-overwrite-via-api-v1-settings · Nota