Which versions of Gpt Researcher are affected by CVE-2026-5632?

gpt-researcher versions 3.4.3 and earlier contain a missing authentication vulnerability in the HTTP REST API that allows any network attacker to access and manipulate data without credentials,…

Is there a public PoC exploit available for CVE-2026-5632?

Yes, a public proof-of-concept exploit is available for CVE-2026-5632. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-5632?

Within 24 hours: Identify all instances of gpt-researcher ≤3.4.3 in production and development environments using asset inventory tools; isolate affected systems to internal-only network access via firewall rules. Within 7 days: Implement network segmentation and API gateway authentication (reverse proxy with credential requirement) in front of affected instances; monitor API logs for unauthorized access patterns. Within 30 days: Upgrade to gpt-researcher version >3.4.3 if vendor releases patched version, or migrate to alternative tool with built-in authentication; validate remediation through penetration testing of API endpoints.

Gpt Researcher CVE-2026-5632

Q: What is the CVSS score of CVE-2026-5632?

CVE-2026-5632 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-19188 MEDIUM

Missing Authentication for Critical Function (CWE-306)

2026-04-06 VulDB

Authentication Bypass Gpt Researcher Assafelovic

5.5

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 07, 2026 - 13:20 vuln.today

Public exploit code

EUVD ID Assigned

Apr 06, 2026 - 07:00 euvd

EUVD-2026-19188

Analysis Generated

Apr 06, 2026 - 07:00 vuln.today

CVE Published

Apr 06, 2026 - 06:45 nvd

MEDIUM 6.9

DescriptionCVE.org

A vulnerability was found in assafelovic gpt-researcher up to 3.4.3. This impacts an unknown function of the component HTTP REST API Endpoint. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Missing authentication in gpt-researcher HTTP REST API (versions ≤3.4.3) allows remote attackers to bypass access controls and interact with the API without credentials. Publicly available exploit code exists (GitHub issue #1695), enabling unauthorized information disclosure, data manipulation, and service disruption. CVSS 7.3 with network attack vector, low complexity, and no privileges required indicates significant exploitability. Vendor has not responded to early disclosure (VulDB submission 785874), leaving users without official patch guidance.

Technical ContextAI

The gpt-researcher project (assafelovic/gpt-researcher) is an autonomous agent framework for comprehensive online research tasks. The vulnerability resides in the HTTP REST API endpoint implementation, classified as CWE-306 (Missing Authentication for Critical Function). The API fails to enforce authentication mechanisms on endpoints that should require authorization, allowing anonymous users to invoke research operations, access stored data, or modify configurations. This architectural flaw stems from inadequate security controls in the API routing layer, where endpoints are exposed without verifying caller identity or permissions. The CPE string cpe:2.3:a:assafelovic:gpt-researcher:*:*:*:*:*:*:*:* indicates all versions through 3.4.3 inherit this design weakness.

RemediationAI

No vendor-released patch identified at time of analysis-the project maintainer has not responded to the vulnerability disclosure submitted via GitHub issue #1695 (https://github.com/assafelovic/gpt-researcher/issues/1695). Users should immediately implement network-level access controls: restrict API endpoint access to trusted IP ranges using firewall rules or reverse proxy authentication (nginx auth_basic, API gateway JWT validation, or VPN-only access). Deploy a web application firewall (WAF) or API gateway with mandatory authentication middleware before routing requests to gpt-researcher endpoints. For critical deployments, consider forking the repository and implementing bearer token authentication or OAuth 2.0 flows on vulnerable endpoints, following the authentication patterns in similar Python Flask/FastAPI projects. Monitor the official GitHub repository and VulDB entries (https://vuldb.com/vuln/355420/cti for threat intelligence updates) for vendor patches. If the API is not required for operational purposes, disable the HTTP service entirely and interact with gpt-researcher through local invocation only.