What is the CVSS score of CVE-2025-61164?

CVE-2025-61164 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Cohere North AI are affected by CVE-2025-61164?

Cohere North AI v1.1.5 contains an unauthenticated information disclosure vulnerability accessible through a WebSocket endpoint without requiring credentials, potentially exposing sensitive data to…

How to fix or mitigate CVE-2025-61164?

Within 24 hours, inventory all systems running Cohere North AI v1.1.5 and immediately restrict network access to the affected WebSocket endpoint via firewall rules. Within 7 days, implement network segmentation limiting WebSocket access to authorized networks only, deploy monitoring and alerting for anomalous connection attempts, and establish baseline data access patterns. Within 30 days, contact Cohere for confirmed patch availability, evaluate upgrade options, and develop a migration plan if patches are not forthcoming.

Cohere North AI CVE-2025-61164

EUVD-2025-210785 HIGH

Information Exposure (CWE-200)

2026-08-26 mitre

GHSA-5j7v-xvq9-pjhj

Information Disclosure Red Hat N A

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

WebSocket endpoint is network-reachable with no authentication required; high confidentiality impact from data disclosure; no integrity or availability impact identified.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 27, 2026 - 22:36 vuln.today

CVSS changed

Aug 27, 2026 - 20:37 NVD

7.5 (HIGH)

CVE Published

Aug 26, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 26, 2026 - 00:00 cve.org

HIGH 7.5

DescriptionCVE.org

Cohere North AI v1.1.5 was discovered to contain an information leak via the WebSocket Endpoint.

AnalysisAI

Unauthenticated information disclosure in Cohere North AI v1.1.5 exposes sensitive data through an improperly secured WebSocket endpoint. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms high confidentiality impact accessible without credentials or user interaction over a network. No public exploit has been identified at time of analysis, and the EPSS score of 0.14% at the 4th percentile indicates negligible observed exploitation activity across the threat landscape.

Technical ContextAI

Cohere North is an enterprise AI workspace platform. The vulnerability class is CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor - arising from a WebSocket endpoint that fails to enforce adequate access controls or message filtering before transmitting data to connected clients. WebSocket connections establish persistent, full-duplex channels; if the server side does not validate session authorization per-message or per-connection, any party that can reach the endpoint network-wise may receive data intended for authenticated users. The NVD CPE entry is listed as 'cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:*', reflecting incomplete vendor/product enumeration in the national database. The only technical detail source is a researcher-published GitHub repository (bdadoa/Cohere---North-AI-1.1.5---Vulnerabilities), which names version 1.1.5 explicitly.

RemediationAI

No vendor-released patch identified at time of analysis. Organizations running Cohere North AI v1.1.5 should contact Cohere directly via https://cohere.com/north to inquire about an updated release or vendor-issued guidance. As an immediate compensating control, restrict network access to the vulnerable WebSocket endpoint using firewall rules or reverse-proxy ACLs, limiting connectivity to known trusted IP ranges and rejecting unauthenticated upgrade requests - this reduces the AV:N attack surface to a local or limited perimeter without requiring application changes. If the WebSocket feature is not operationally required, disabling it at the reverse-proxy layer eliminates the attack surface entirely, though real-time functionality dependent on the endpoint will be lost. Monitor the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2025-61164) and the researcher repository for updated patch or version information.