Which versions of Cognee are affected by EUVD-2026-42095?

Cognee instances before version 1.2.0 contain a critical configuration hijacking vulnerability that allows any remote attacker to globally redirect all users' LLM operations to an attacker-controlled…. A patch is available.

Is there a public PoC exploit available for EUVD-2026-42095?

Yes, a public proof-of-concept exploit is available for EUVD-2026-42095. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate EUVD-2026-42095?

Within 24 hours: (1) Identify all systems running Cognee before version 1.2.0 and assess exploitation risk; (2) upgrade to Cognee v1.2.0 across all instances; (3) review /api/v1/settings endpoint access logs for unauthorized configuration changes. Within 7 days: (1) complete patch deployment to all Cognee instances; (2) conduct audit of LLM configuration change logs and query patterns for evidence of compromise; (3) notify relevant stakeholders of exposure window and potential data access. Within 30 days: (1) complete forensic investigation to determine which data was accessed and exfiltrated; (2) implement enhanced logging and monitoring on /api/v1/settings endpoint; (3) document incident response and remediation for compliance records.

Cognee EUVD-2026-42095

Q: What is the CVSS score of EUVD-2026-42095?

EUVD-2026-42095 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

| CVE-2026-58473 CRITICAL

Missing Authorization (CWE-862)

2026-07-07 VulnCheck

GHSA-49f7-whx5-4256

Authentication Bypass Cognee

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

10.0 CRITICAL

Unauthenticated network access via self-registration justifies PR:N/AV:N/AC:L; overwriting a shared singolo config to hijack all users' data is a scope change (S:C) with high C and I but no availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 07, 2026 - 21:27 vuln.today

DescriptionCVE.org

Cognee before 1.2.0 contains an improper access control vulnerability that allows unauthenticated attackers to overwrite the global LLM provider configuration by self-registering an account and calling the settings endpoint, which performs no admin or superuser check. Attackers can redirect all LLM operations instance-wide to an attacker-controlled endpoint by exploiting the process-wide singleton configuration cache, enabling exfiltration of prompts, uploaded documents, extracted entities, and knowledge graph content from all users.

AnalysisAI

Instance-wide LLM configuration hijacking in Cognee before 1.2.0 lets any remote attacker self-register a normal account and overwrite the global LLM provider settings through the /api/v1/settings endpoint, which performs no admin or superuser authorization check. Because the configuration is held in a process-wide singleton cache, a single call redirects every user's LLM operations to an attacker-controlled endpoint, exfiltrating prompts, uploaded documents, extracted entities, and knowledge-graph content. This is confirmed publicly available exploit code exists (reported by VulnCheck, with a released vendor patch in v1.2.0), and the CVSS 4.0 score is 9.3 (Critical).

Technical ContextAI

Cognee is an open-source AI memory/knowledge-graph framework (vendor topoteretes) that ingests documents and builds knowledge graphs by delegating operations to an external LLM provider. The affected component is the settings management API (per the VulnCheck advisory, api/v1/settings), which mutates the provider/base-URL/model/key configuration used by all LLM calls. The root cause is CWE-862 (Missing Authorization): the endpoint updates a sensitive, global setting without verifying the caller is an admin or superuser. The impact is amplified by an architectural choice - the LLM configuration is stored in a process-wide singleton cache shared across all sessions and users - so one write by a low-privilege self-registered account changes behavior for the entire instance rather than just the attacker's own scope.

RemediationAI

Vendor-released patch: upgrade Cognee to v1.2.0 or later (https://github.com/topoteretes/cognee/releases/tag/v1.2.0); the fix is in commit d10b1b77e2157c6238fd4d1acb1923a048991699, which adds the missing admin/superuser authorization check to the settings endpoint. If you cannot upgrade immediately, disable open/self-registration so unauthenticated users cannot obtain an account to reach the endpoint (trade-off: breaks any legitimate self-service onboarding), and restrict network access to the /api/v1/settings endpoint via a reverse proxy or WAF rule allowing only trusted admin IPs (trade-off: requires that admins still be able to reach it for legitimate configuration). Additionally, pin and monitor the configured LLM provider base URL/endpoint and alert on unexpected changes so a hijack is detected quickly. Review the advisory at https://www.vulncheck.com/advisories/cognee-unauthorized-llm-configuration-overwrite-via-api-v1-settings for details.