Vulnerabilidades do Topoteretes Cognee
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Topoteretes Cognee: 2 registro(s), com versões afetadas e correções.
CVE-2026-105141
Média · 6.3
CWE-259 04/10/2026
topoteretes cognee JWT Signing Key get_api_auth_backend.py get_user_id_by_email hard-coded credentials
A security flaw has been discovered in topoteretes cognee up to 1.5.4. The affected element is the function get_user_id_by_email of the file cognee/modules/users/authentication/get_api_auth_backend.py of the component JWT Signing Key Handler. The manipulation of the argument FASTAPI_USERS_JWT_SECRET results in hard-coded credentials. The attack may be launched remotely. Upgrading to version 1.6.0 is sufficient to fix this issue. The patch is identified as fa65fc0cd86cdba48d19aa76e36be862be982f5d. Upgrading the affected component is advised.
CVE-2026-58473
Crítica · 9.1
CWE-306 07/07/2026
Cognee < 1.2.0 Unauthorized LLM Configuration Overwrite via /api/v1/settings
Cognee before 1.2.0 contains an improper access control vulnerability that allows unauthenticated attackers to overwrite the global LLM provider configuration by self-registering an account and calling the settings endpoint, which performs no admin or superuser check. Attackers can redirect all LLM operations instance-wide to an attacker-controlled endpoint by exploiting the process-wide singleton configuration cache, enabling exfiltration of prompts, uploaded documents, extracted entities, and knowledge graph content from all users.