Which versions of Vanna are affected by CVE-2026-5320?

CVE-2026-5320 is a critical authentication bypass in vanna-ai Chat API (versions up to 2.0.2) that allows unauthenticated attackers to perform arbitrary operations remotely.

Is there a public PoC exploit available for CVE-2026-5320?

Yes, a public proof-of-concept exploit is available for CVE-2026-5320. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-5320?

Within 24 hours: audit network access logs to vanna-ai API endpoints (/api/vanna/v2/) for unauthorized requests; isolate affected vanna-ai instances from untrusted networks if running versions ≤2.0.2. Within 7 days: implement network-level authentication controls (API gateway, WAF rules requiring authentication headers) as interim protection; contact vanna-ai vendor for patch timeline and status. Within 30 days: upgrade to patched version immediately upon vendor release; if no patch released, evaluate alternative solutions or persistent network segmentation.

Vanna CVE-2026-5320

Q: What is the CVSS score of CVE-2026-5320?

CVE-2026-5320 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-18120 MEDIUM

Missing Authentication for Critical Function (CWE-306)

2026-04-02 VulDB

GHSA-j638-g9qc-36f4

Authentication Bypass Vanna Vanna Ai

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 03, 2026 - 16:10 vuln.today

Public exploit code

EUVD ID Assigned

Apr 02, 2026 - 04:30 euvd

EUVD-2026-18120

Analysis Generated

Apr 02, 2026 - 04:30 vuln.today

CVE Published

Apr 02, 2026 - 03:45 nvd

MEDIUM 6.9

DescriptionCVE.org

A vulnerability was detected in vanna-ai vanna up to 2.0.2. Affected by this vulnerability is an unknown functionality of the file /api/vanna/v2/ of the component Chat API Endpoint. Performing a manipulation results in missing authentication. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Missing authentication in vanna-ai vanna Chat API endpoint (/api/vanna/v2/) allows unauthenticated remote attackers to perform unauthorized operations with low-complexity attacks. Affects vanna-ai vanna versions up to 2.0.2. Publicly available exploit code exists (GitHub POC published), increasing immediate exploitation risk. CVSS 7.3 reflects network-accessible attack vector with no authentication required and impacts to confidentiality, integrity, and availability. Vendor did not respond to early disclosure notification.

Technical ContextAI

Vanna-ai vanna is an AI-powered SQL generation framework that allows users to query databases using natural language. This vulnerability (CWE-306: Missing Authentication for Critical Function) affects the Chat API endpoint at /api/vanna/v2/, a component that processes user interactions with the AI system. The flaw permits direct interaction with the API without credential verification, enabling unauthorized parties to leverage the framework's database querying capabilities. The affected CPE (cpe:2.3:a:vanna-ai:vanna) indicates all versions through 2.0.2 are vulnerable. The CVSS vector (AV:N/AC:L/PR:N) confirms network-accessible exploitation with low attack complexity and no privileges required, making this a straightforward authentication bypass vulnerability in a critical API component.

RemediationAI

No vendor-released patch identified at time of analysis, as the maintainer did not respond to responsible disclosure attempts. Immediate compensating controls are critical: implement network-layer authentication such as API gateway authentication, restrict access to the /api/vanna/v2/ endpoint using firewall rules or reverse proxy ACLs to trusted IP ranges only, deploy web application firewall (WAF) rules requiring valid authentication tokens before reaching the endpoint, or temporarily disable the Chat API endpoint if not business-critical. Monitor for unauthorized API access attempts through access logs and intrusion detection systems. Organizations should consider evaluating alternative SQL generation frameworks with active security maintenance. Reference VulDB entries for ongoing monitoring: https://vuldb.com/vuln/354652 and exploit documentation at https://github.com/August829/CVEP/issues/13. Subscribe to vanna-ai repository updates for potential future security patches.