Cognee CVE-2026-58473

The attacker must be able to reach the Cognee API over the network and create an account via self-registration (the description explicitly says 'self-registering an account'), then call the settings endpoint that performs no admin/superuser check. No user interaction and no pre-existing privileged credentials are required (CVSS PR:N/UI:N), and the process-wide singleton configuration cache means a single successful write affects all users instance-wide. The primary limiting factor is deployment configuration: instances that disable open self-registration, place the settings endpoint behind an authenticated admin-only proxy, or are not network-exposed are substantially harder to exploit. Affected versions are all releases before 1.2.0.

All signals align toward high real-world priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation with no user interaction, and VC:H/VI:H captures the high confidentiality and integrity impact of redirecting and reading all LLM traffic; VA:N and subsequent-system metrics N are consistent with data theft/tampering rather than availability loss. The 9.3 (Critical) base score is corroborated by publicly available exploit code and a credible reporter (VulnCheck). No EPSS score or SSVC decision was provided in the input, so probabilistic exploitation likelihood cannot be quantified here, and the CVE is not listed in CISA KEV in the provided data - meaning this is 'publicly available exploit code exists' but NOT confirmed active exploitation. One nuance worth verifying: exploitation requires the ability to self-register an account, so instances that disable open registration materially reduce exposure even though CVSS scores it PR:N (self-registration is treated as no meaningful privilege barrier).

An attacker reaches a publicly exposed Cognee instance, uses the open self-registration flow to create an ordinary account, then calls the settings endpoint to point the global LLM provider base URL at a server they control. From that moment every user's prompts, uploaded documents, and generated knowledge-graph content are routed through the attacker's endpoint and silently captured. Publicly available exploit code lowers the skill required, and the low attack complexity means the whole chain can be scripted.