PT-2026-30571 · Assafelovic · Assafelovic Gpt-Researcher

Yu-Bao · Published 2026-04-06 · Updated 2026-04-06 · CVE-2026-5632

Positive Technologies · (AI Summary)

CVSS v2.0

7.5

High

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions assafelovic gpt-researcher versions up to 3.4.3

Description A flaw exists in the HTTP REST API Endpoint component of assafelovic gpt-researcher. Manipulation of this endpoint results in missing authentication, allowing for remote exploitation. The exploit is publicly available. The project maintainers were notified but have not yet responded.

Recommendations Versions prior to 3.4.3 should restrict access to the affected HTTP REST API Endpoint.

Exploit

Fix

Improper Authentication

Missing Authentication

Weakness Enumeration

CWE-287

CWE-306

Related Identifiers

CVE-2026-5632

Affected Products

Assafelovic Gpt-Researcher

References · 11

• 🔥 https://github.com/assafelovic/gpt-researcher/issues/1695 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-5632 · Security Note
• https://vuldb.com/vuln/355420 · Note
• https://vuldb.com/submit/785874 · Note
• https://twitter.com/cyberbivash/status/2041064961435140187 · Twitter Post
• https://vuldb.com/vuln/355420/cti · Note
• https://twitter.com/CVEnew/status/2041054122732933336 · Twitter Post
• https://twitter.com/DFIR_Lab/status/2041059739832868867 · Twitter Post
• https://twitter.com/infoflowcloud/status/2041054701244867058 · Twitter Post
• https://twitter.com/cyberbivash/status/2041077643513155913 · Twitter Post
• https://github.com/assafelovic/gpt-researcher · Note