EUVD-2026-18120
GHSA-j638-g9qc-36f4
CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4Description
A vulnerability was detected in vanna-ai vanna up to 2.0.2. Affected by this vulnerability is an unknown functionality of the file /api/vanna/v2/ of the component Chat API Endpoint. Performing a manipulation results in missing authentication. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Analysis
Missing authentication in vanna-ai vanna Chat API endpoint (/api/vanna/v2/) allows unauthenticated remote attackers to perform unauthorized operations with low-complexity attacks. Affects vanna-ai vanna versions up to 2.0.2. …
Sign in for full analysis, threat intelligence, and remediation guidance.
Remediation
Within 24 hours: audit network access logs to vanna-ai API endpoints (/api/vanna/v2/) for unauthorized requests; isolate affected vanna-ai instances from untrusted networks if running versions ≤2.0.2. Within 7 days: implement network-level authentication controls (API gateway, WAF rules requiring authentication headers) as interim protection; contact vanna-ai vendor for patch timeline and status. …
Sign in for detailed remediation steps.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today