getzep graphiti CVE-2026-90601

The graphiti server component (server/graph_service/) must be network-reachable from the attacker - internet exposure is not required, but any network path (cloud VPC, internal LAN) to the listening port suffices. The vulnerable condition is the default state of versions ≤ 0.30.2: both routers are completely unauthenticated out of the box, no opt-in misconfiguration is needed. Exploitation is bounded to the graphiti data plane - reading episode data and writing new or modified episodes. It does not provide OS command execution, access to the underlying Neo4j or OpenAI credentials configured server-side, or privilege escalation beyond the service's own data. Instances isolated behind a firewall or reachable only from trusted application hosts have their exposure significantly reduced.

The CVSS 4.0 score of 6.9 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L) accurately reflects the technical reality: network-reachable with no prerequisites, but limited to the service's data plane - graph episode reads and writes - with no code execution or OS-level access. The no-authentication condition is unconditional in affected versions, not gated on a misconfiguration. Real-world risk is heavily deployment-topology dependent: graphiti is typically an internal backend component, so network segmentation may naturally restrict exposure. However, instances deployed with internet-facing ports or inside flat cloud VPCs are fully exposed. No KEV listing and no known POC exist, keeping automated mass exploitation unlikely. The patch (PR #1739) was pending merge at time of disclosure, so all deployed instances of ≤ 0.30.2 without manual patching remain vulnerable. EPSS data was not provided; given the niche deployment footprint, broad scanning-based exploitation is considered low probability.

An attacker who can reach the graphiti server on its listening port sends a plain HTTP GET to /episodes/<group_id>?last_n=100 with no Authorization header and receives stored knowledge-graph episodes in the response. To corrupt or poison the graph, the attacker POSTs crafted episode data to the ingest router, silently modifying the LLM application's memory. No credentials, special tooling, or prior reconnaissance beyond port discovery is required.