CVE-2026-105141

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-105141

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-105141.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-105141

Published

2026-10-04T07:45:15Z

Modified

2026-10-20T11:15:09Z

Severity

5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X CVSS Calculator

Summary

topoteretes cognee JWT Signing Key get_api_auth_backend.py get_user_id_by_email hard-coded credentials

Details

A security flaw has been discovered in topoteretes cognee up to 1.5.4. The affected element is the function get_user_id_by_email of the file cognee/modules/users/authentication/get_api_auth_backend.py of the component JWT Signing Key Handler. The manipulation of the argument FASTAPI_USERS_JWT_SECRET results in hard-coded credentials. The attack may be launched remotely. Upgrading to version 1.6.0 is sufficient to fix this issue. The patch is identified as fa65fc0cd86cdba48d19aa76e36be862be982f5d. Upgrading the affected component is advised.

Database specific

{
    "cna_assigner":  "VulDB",
    "cwe_ids":  [
        "CWE-259",
        "CWE-798"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/105xxx/CVE-2026-105141.json"
}

References

Affected packages

Git / github.com/topoteretes/cognee

Affected ranges

Type

GIT

Repo

https://github.com/topoteretes/cognee

Events

Introduced

Fixed

fa65fc0cd86cdba48d19aa76e36be862be982f5d

Fixed

bbec4a28b271103c291eeabb69ec873e69f44db6

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "1.5.4"
                }
            ],
            "source":  "DESCRIPTION"
        },
        {
            "range":  [
                {
                    "fixed":  "fa65fc0cd86cdba48d19aa76e36be862be982f5d"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "v1.6.0",
            "range":  [
                {
                    "fixed":  "bbec4a28b271103c291eeabb69ec873e69f44db6"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

0.*

0.0.1

1.*

1.5.0

1.5.1

1.5.2

1.5.3

1.5.4

v.*

v.0.1.1

v.0.2.2

v0.*

v0.1.0

v0.1.1

v0.1.12

v0.1.13

v0.1.14

v0.1.15

v0.1.16

v0.1.17

v0.1.18

v0.1.19

v0.1.2

v0.1.20

v0.1.21

v0.1.22

v0.1.23

v0.1.24

v0.1.25

v0.1.26

v0.1.27

v0.1.28

v0.1.29

v0.1.3

v0.1.30

v0.1.31

v0.1.32

v0.1.33

v0.1.34

v0.1.35

v0.1.4

v0.1.5

v0.1.6

v0.1.7

v0.2.0

v0.2.0.dev0

v0.2.1

v0.2.1.dev1

v0.2.1.dev6

v0.2.2

v0.2.3

v0.2.4

v0.3.0

v0.3.1

v0.3.2

v0.3.3

v0.3.4

v0.3.4.dev0

v0.3.4.dev1

v0.3.4.dev2

v0.3.4.dev3

v0.3.4.dev4

v0.3.5

v0.3.6

v0.3.7

v0.3.8

v0.3.9

v0.4.0

v0.4.1

v0.5.0

v0.5.0.dev0

v0.5.0.dev1

v0.5.1

v0.5.1.dev0

v0.5.2

v0.5.2.dev0

v0.5.3

v0.5.3.dev0

v0.5.3.dev1

v0.5.4

v0.5.4.dev0

v0.5.4.dev1

v0.5.5

v0.5.5.dev0

v0.5.6

v0.5.7

v0.5.7.dev0

v0.5.8

v1.*

v1.0.0

v1.0.0.dev0

v1.0.1

v1.0.1.dev0

v1.0.1.dev2

v1.0.1.dev3

v1.0.1.dev4

v1.0.2

v1.0.3

v1.0.4

v1.0.5

v1.0.6

v1.0.7

v1.0.8

v1.0.9

v1.1.0

v1.1.1

v1.1.2

v1.1.3

v1.2.0

v1.2.0.dev1

v1.2.1

v1.2.2

v1.3.0

v1.4.0

v1.4.0.dev1

v1.4.0.dev4

v1.4.1

v1.4.1.dev1

v1.4.2

v1.5.0

v1.5.0.dev3

v1.5.0.dev4

v1.5.0.dev5

v1.5.1

v1.5.2

v1.5.3

v1.5.3.dev1

v1.5.4

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-105141.json"