EUVD-2026-12103Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker hosts malicious webpage
-
DeliveryVictim visits site from private network
-
ExploitBrowser grants Private Network Access via user interaction
-
ExecutionExploit sends unauthenticated requests to AnythingLLM
-
ImpactExecute arbitrary agent commands
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A02:2025 - Security Misconfiguration
ASVS 5.0
V13 - Configuration CORS policy restriction
|
| Exploitation Conditions | AnythingLLM version 1.11.1 or earlier with default installation (no password or API key configured), accessed from a private network context where browser Private Network Access is granted by user interaction, with CORS policy accepting any origin. |
| Impact | Despite the high CVSS score of 7.1, real-world exploitation risk is moderate. The CVSS vector (AV:N/AC:H/PR:N/UI:R) indicates network-based attacks with high complexity requiring user interaction. No EPSS data or KEV listing suggests this isn't being actively exploited. The attack complexity is high due to PNA browser protections limiting attacks to LAN-only scenarios. No public POC is referenced. Using SSVC framework: exploitation is not active, attacks would be semi-automated (requiring user interaction), with high technical impact (full data access). This is a priority for organizations with untrusted LAN environments but lower priority for typical home/trusted network deployments. |
| Exploit ScenarioDerived | An attacker on the same local network could craft a malicious webpage that, when visited by a user on that network, sends unauthorized requests to the AnythingLLM instance. Due to the missing authentication and permissive CORS policy, the attacker could read sensitive chat histories, inject malicious content, or modify LLM contexts. The attack requires the victim to visit the malicious page while connected to the same network as the AnythingLLM instance. No public proof-of-concept currently exists in the referenced materials. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 13, 2026
AnythingLLM versions 1.11.1 and earlier contain an authentication bypass vulnerability on default installations where the application's HTTP endpoints and WebSocket connections lack proper authentication and accept requests from any origin. While rated CVSS 7.1, exploitation is limited to attackers on the same local network due to browser Private Network Access (PNA) protections, making this a medium-priority issue for most deployments.
RemediationAI
Upgrade to AnythingLLM version 1.11.2 or later. As an immediate workaround, configure authentication by setting a password or API key for the installation. The vendor advisory (https://github.com/Mintplex-Labs/anything-llm/security/advisories/GHSA-24qj-pw4h-3jmm) should be consulted for detailed patch information. For installations that must remain on vulnerable versions, ensure the application is only accessible from trusted networks and implement network segmentation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
AnythingLLM (CPE: cpe:2.3:a:mintplex-labs:anything-llm:*:*:*:*:*:*:*:*) is an application that converts content into LLM-usable context. The vulnerability stems from CWE-942 (Overly Permissive Cross-domain Whitelist), where the server's CORS policy accepts any origin (*) combined with missing authentication on default installations. The AnythingLLM Desktop version binds to 127.0.0.1 (loopback), and while modern browsers (Chrome, Edge, Firefox) implement Private Network Access controls that block public-to-private network requests, the lack of authentication still exposes the service to same-network attacks.
Know when Chrome gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
DescriptionGitHub Advisory
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.11.1 and earlier, On default installations where no password or API key has been configured, all HTTP endpoints and the agent WebSocket lack authentication, and the server's CORS policy accepts any origin. AnythingLLM Desktop binds to 127.0.0.1 (loopback) by default. Modern browsers (Chrome, Edge, Firefox) implement Private Network Access (PNA). This explicitly blocks public websites from making requests to local IP addresses. Exploitation is only viable from within the same local network (LAN) due to browser-level blocking of public-to-private requests.
Executive ViewAI
AnythingLLM installations versions 1.11.1 and earlier are vulnerable to authentication bypass attacks, but exploitation is restricted to attackers already present on the same local network due to browser security protections. Organizations using AnythingLLM should prioritize remediation based on network exposure and data sensitivity, particularly for systems handling confidential information.
Implement network-layer access controls to restrict AnythingLLM connectivity to known trusted networks only; deploy a reverse proxy (nginx/Apache) with authentication in front of AnythingLLM endpoints; segment AnythingLLM to internal networks only and prohibit internet exposure; disable WebSocket endpoints if not required for operations; implement firewall rules restricting access by source IP; monitor network logs for unauthorized access attempts to AnythingLLM ports.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in AnythingLLM Authentication Bypass and XSS
View all 3Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13
Exploit-DB