PT-2026-56255 · Topoteretes · Cognee

Yu Sun · Published 2026-07-07 · Updated 2026-07-07 · CVE-2026-58473

Mitre

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Cognee before 1.2.0 contains an improper access control vulnerability that allows unauthenticated attackers to overwrite the global LLM provider configuration by self-registering an account and calling the settings endpoint, which performs no admin or superuser check. Attackers can redirect all LLM operations instance-wide to an attacker-controlled endpoint by exploiting the process-wide singleton configuration cache, enabling exfiltration of prompts, uploaded documents, extracted entities, and knowledge graph content from all users.

Exploit

Fix

Missing Authorization

Missing Authentication

Weakness Enumeration

CWE-862

CWE-306

Related Identifiers

CVE-2026-58473

Affected Products

Cognee

References · 5

• 🔥 https://github.com/topoteretes/cognee/issues/3084 · Exploit
• https://github.com/topoteretes/cognee/commit/d10b1b77e2157c6238fd4d1acb1923a048991699 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-58473 · Security Note
• https://github.com/topoteretes/cognee/releases/tag/v1.2.0 · Note
• https://vulncheck.com/advisories/cognee-unauthorized-llm-configuration-overwrite-via-api-v1-settings · Note