Graphiti
Monthly
High severity vulnerability in Graphiti. #
The graphiti FastAPI-based graph memory REST API (getzep/graphiti ≤ 0.30.2) shipped its ingest and retrieve routers with zero authentication - no API key, no token, no session check of any kind. Any unauthenticated remote caller with network access to the service can read stored knowledge-graph episodes or inject and overwrite graph data by sending ordinary HTTP requests. No public exploit code has been identified, but the barrier to exploitation is effectively zero: the attack requires only HTTP client access and knowledge of endpoint paths. No KEV listing at time of analysis.
High severity vulnerability in Graphiti. #
The graphiti FastAPI-based graph memory REST API (getzep/graphiti ≤ 0.30.2) shipped its ingest and retrieve routers with zero authentication - no API key, no token, no session check of any kind. Any unauthenticated remote caller with network access to the service can read stored knowledge-graph episodes or inject and overwrite graph data by sending ordinary HTTP requests. No public exploit code has been identified, but the barrier to exploitation is effectively zero: the attack requires only HTTP client access and knowledge of endpoint paths. No KEV listing at time of analysis.