Which versions of Vanna are affected by CVE-2026-6977?

Vanna AI versions up to 2.0.2 contain an authentication bypass vulnerability in the Legacy Flask API that allows unauthenticated remote attackers to access sensitive data and modify system…

Is there a public PoC exploit available for CVE-2026-6977?

Yes, a public proof-of-concept exploit is available for CVE-2026-6977. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-6977?

Within 24 hours: Identify all systems running Vanna AI versions ≤2.0.2 and isolate them from production networks or restrict API access via firewall rules to trusted IPs only. Within 7 days: Upgrade to Vanna AI version 2.0.3 or later if available from vendor; if unavailable, implement network-level authentication proxies (e.g., OAuth2 gateway, reverse proxy with JWT validation) in front of the Legacy Flask API. Within 30 days: Conduct full audit of API access logs for versions ≤2.0.2 to identify unauthorized access; rotate all data credentials and secrets that may have been exposed; implement application-level API versioning to sunset Legacy Flask endpoints.

Vanna CVE-2026-6977

Q: What is the CVSS score of CVE-2026-6977?

CVE-2026-6977 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-25653 MEDIUM

Improper Authorization (CWE-285)

2026-04-25 VulDB

Authentication Bypass Python Vanna Vanna Ai

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:12 NVD

6.9 (MEDIUM) 5.5 (MEDIUM)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

Severity Changed

Apr 25, 2026 - 11:22 NVD

HIGH MEDIUM

CVSS changed

Apr 25, 2026 - 11:22 NVD

7.3 (HIGH) 6.9 (MEDIUM)

Analysis Generated

Apr 25, 2026 - 10:45 vuln.today

EUVD ID Assigned

Apr 25, 2026 - 10:30 euvd

EUVD-2026-25653

Analysis Generated

Apr 25, 2026 - 10:30 vuln.today

CVE Published

Apr 25, 2026 - 10:15 nvd

MEDIUM 5.5

DescriptionCVE.org

A security vulnerability has been detected in vanna-ai vanna up to 2.0.2. The affected element is an unknown function of the component Legacy Flask API. The manipulation leads to improper authorization. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Improper authorization in Vanna AI's Legacy Flask API allows remote unauthenticated attackers to bypass authentication controls and gain unauthorized access. Affects Vanna versions up to 2.0.2. A publicly available proof-of-concept exploit has been disclosed on GitHub, though vendor has not responded to disclosure. CVSS 7.3 severity reflects network-accessible attack with low complexity requiring no privileges or user interaction, enabling confidentiality, integrity, and availability impacts.

Technical ContextAI

Vanna is a Python-based AI framework for text-to-SQL generation, providing a Flask API for interaction. The Legacy Flask API component contains an improper authorization vulnerability (CWE-285), a class of security weakness where the software does not properly perform access control checks, allowing actors to obtain unintended access to resources or functionality. The CPE identifier cpe:2.3:a:vanna-ai:vanna targets the vanna-ai product namespace. The vulnerability exists in legacy API endpoints that likely fail to validate authorization tokens or session credentials before processing requests, enabling unauthorized API operations against the Vanna service.

RemediationAI

Upstream fix version not independently confirmed at time of analysis. The vendor has not responded to vulnerability disclosure or released a patched version for versions up to 2.0.2. Organizations should immediately implement compensating controls: Disable or restrict network access to the Legacy Flask API endpoints using firewall rules or API gateway policies, limiting exposure to trusted internal networks only. Deploy authentication proxy (such as nginx with HTTP basic auth or OAuth2 proxy) in front of Vanna Flask endpoints to enforce authentication before requests reach the vulnerable component, though this adds latency and operational complexity. Monitor Vanna GitHub repository and PyPI releases for version 2.0.3 or later containing authorization fixes. Subscribe to VulDB advisory https://vuldb.com/vuln/359520 for patch notifications. Consider migrating to alternative text-to-SQL frameworks with active security maintenance if vendor responsiveness does not improve within your organization's risk tolerance window.