CVE-2026-58473

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-58473
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-58473.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-58473
Published
2026-07-07T20:34:54.943Z
Modified
2026-08-12T03:51:49.297599648Z
Severity
  • 9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Cognee < 1.2.0 Unauthorized LLM Configuration Overwrite via /api/v1/settings
Details

Cognee before 1.2.0 contains an improper access control vulnerability that allows unauthenticated attackers to overwrite the global LLM provider configuration by self-registering an account and calling the settings endpoint, which performs no admin or superuser check. Attackers can redirect all LLM operations instance-wide to an attacker-controlled endpoint by exploiting the process-wide singleton configuration cache, enabling exfiltration of prompts, uploaded documents, extracted entities, and knowledge graph content from all users.

Database specific 
{
    "cwe_ids": [
        "CWE-306",
        "CWE-862"
    ],
    "cna_assigner": "VulnCheck",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/58xxx/CVE-2026-58473.json"
}
References

Affected packages

Git / github.com/topoteretes/cognee

Affected ranges

Type
GIT
Repo
https://github.com/topoteretes/cognee
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
308e42a311131fed5ea57cacbd7951e97372bbe1
Fixed
d10b1b77e2157c6238fd4d1acb1923a048991699
Database specific
Show details 
{
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.2.0"
        }
    ]
}

Affected versions

0.*
0.0.1
v.*
v.0.1.1
v.0.2.2
v0.*
v0.1.0
v0.1.1
v0.1.12
v0.1.13
v0.1.14
v0.1.15
v0.1.16
v0.1.17
v0.1.18
v0.1.19
v0.1.2
v0.1.20
v0.1.21
v0.1.22
v0.1.23
v0.1.24
v0.1.25
v0.1.26
v0.1.27
v0.1.28
v0.1.29
v0.1.3
v0.1.30
v0.1.31
v0.1.32
v0.1.33
v0.1.34
v0.1.35
v0.1.4
v0.1.5
v0.1.6
v0.1.7
v0.2.0
v0.2.0.dev0
v0.2.1
v0.2.1.dev1
v0.2.1.dev6
v0.2.2
v0.2.3
v0.2.4
v0.3.0
v0.3.1
v0.3.2
v0.3.3
v0.3.4
v0.3.4.dev0
v0.3.4.dev1
v0.3.4.dev2
v0.3.4.dev3
v0.3.4.dev4
v0.3.5
v0.3.6
v0.3.7
v0.3.8
v0.3.9
v0.4.0
v0.4.1
v0.5.0
v0.5.0.dev0
v0.5.0.dev1
v0.5.1
v0.5.1.dev0
v0.5.2
v0.5.2.dev0
v0.5.3
v0.5.3.dev0
v0.5.3.dev1
v0.5.4
v0.5.4.dev0
v0.5.4.dev1
v0.5.5
v0.5.5.dev0
v0.5.6
v0.5.7
v0.5.7.dev0
v0.5.8
v1.*
v1.0.0
v1.0.0.dev0
v1.0.1
v1.0.1.dev0
v1.0.1.dev2
v1.0.1.dev3
v1.0.1.dev4
v1.0.2
v1.0.3
v1.0.4
v1.0.5
v1.0.6
v1.0.7
v1.0.8
v1.0.9
v1.1.0
v1.1.1
v1.1.2
v1.1.3
v1.2.0.dev1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-58473.json"