CVE-2026-58473

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-58473

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-58473.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-58473

Aliases

Published

2026-07-07T20:34:54Z

Modified

2026-10-28T02:30:23Z

Severity

9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Cognee < 1.2.0 Unauthorized LLM Configuration Overwrite via /api/v1/settings

Details

Cognee before 1.2.0 contains an improper access control vulnerability that allows unauthenticated attackers to overwrite the global LLM provider configuration by self-registering an account and calling the settings endpoint, which performs no admin or superuser check. Attackers can redirect all LLM operations instance-wide to an attacker-controlled endpoint by exploiting the process-wide singleton configuration cache, enabling exfiltration of prompts, uploaded documents, extracted entities, and knowledge graph content from all users.

Database specific

{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-306",
        "CWE-862"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/58xxx/CVE-2026-58473.json"
}

References

Affected packages

Git / github.com/topoteretes/cognee

Affected ranges

Type

GIT

Repo

https://github.com/topoteretes/cognee

Events

Introduced

Fixed

308e42a311131fed5ea57cacbd7951e97372bbe1

Fixed

d10b1b77e2157c6238fd4d1acb1923a048991699

Database specific

Show details

{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "1.2.0"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "original_tag": "v1.2.0",
            "range": [
                {
                    "fixed": "308e42a311131fed5ea57cacbd7951e97372bbe1"
                }
            ],
            "source": "REFERENCES_TAG"
        },
        {
            "range": [
                {
                    "fixed": "d10b1b77e2157c6238fd4d1acb1923a048991699"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

0.*

0.0.1

v.*

v.0.1.1

v.0.2.2

v0.*

v0.1.0

v0.1.1

v0.1.12

v0.1.13

v0.1.14

v0.1.15

v0.1.16

v0.1.17

v0.1.18

v0.1.19

v0.1.2

v0.1.20

v0.1.21

v0.1.22

v0.1.23

v0.1.24

v0.1.25

v0.1.26

v0.1.27

v0.1.28

v0.1.29

v0.1.3

v0.1.30

v0.1.31

v0.1.32

v0.1.33

v0.1.34

v0.1.35

v0.1.4

v0.1.5

v0.1.6

v0.1.7

v0.2.0

v0.2.0.dev0

v0.2.1

v0.2.1.dev1

v0.2.1.dev6

v0.2.2

v0.2.3

v0.2.4

v0.3.0

v0.3.1

v0.3.2

v0.3.3

v0.3.4

v0.3.4.dev0

v0.3.4.dev1

v0.3.4.dev2

v0.3.4.dev3

v0.3.4.dev4

v0.3.5

v0.3.6

v0.3.7

v0.3.8

v0.3.9

v0.4.0

v0.4.1

v0.5.0

v0.5.0.dev0

v0.5.0.dev1

v0.5.1

v0.5.1.dev0

v0.5.2

v0.5.2.dev0

v0.5.3

v0.5.3.dev0

v0.5.3.dev1

v0.5.4

v0.5.4.dev0

v0.5.4.dev1

v0.5.5

v0.5.5.dev0

v0.5.6

v0.5.7

v0.5.7.dev0

v0.5.8

v1.*

v1.0.0

v1.0.0.dev0

v1.0.1

v1.0.1.dev0

v1.0.1.dev2

v1.0.1.dev3

v1.0.1.dev4

v1.0.2

v1.0.3

v1.0.4

v1.0.5

v1.0.6

v1.0.7

v1.0.8

v1.0.9

v1.1.0

v1.1.1

v1.1.2

v1.1.3

v1.2.0.dev1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-58473.json"