Is CVE-2026-105141 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-105141 being exploited in the wild.

How severe is CVE-2026-105141?

Medium severity, with a CVSS score of 6.3, published 4 October 2026.

Which products and versions are affected?

Topoteretes Cognee up to 1.5.4.

How is CVE-2026-105141 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-105141?

Check whether you run Topoteretes Cognee at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-105141: Topoteretes cognee hard-coded JWT signing key in authentication backend

CVE-2026-105141 · Severity: medium · CVSS 6.3 · Published 2026-10-04

Cognee is an open-source AI memory platform that provides authentication services for agents. An authentication backend component used a hard-coded JWT signing secret when environment variables were not configured, allowing attackers to forge authentication tokens and gain unauthorized access to deployments. This affects all instances of cognee up to version 1.5.4 that did not explicitly set the FASTAPI_USERS_JWT_SECRET environment variable.

Technologies: Topoteretes Cognee. Vendors: Topoteretes.

Quick answers

Is CVE-2026-105141 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-105141 being exploited in the wild.
How severe is CVE-2026-105141?: Medium severity, with a CVSS score of 6.3, published 4 October 2026.
Which products and versions are affected?: Topoteretes Cognee up to 1.5.4.
Is there a fix for CVE-2026-105141?: Yes: fixed in 1.6.0. Until then: Set the FASTAPI_USERS_JWT_SECRET environment variable to a strong, random secret before deploying cognee. Additionally, set the password-reset and verification token secret environment variables to prevent similar fallback issues. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-105141 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-105141?: Check whether you run Topoteretes Cognee at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.6.0

Set the FASTAPI_USERS_JWT_SECRET environment variable to a strong, random secret before deploying cognee. Additionally, set the password-reset and verification token secret environment variables to prevent similar fallback issues.

Technical details

The JWT Signing Key Handler in cognee/modules/users/authentication/get_api_auth_backend.py fell back to a publicly known literal string "super_secret" when the FASTAPI_USERS_JWT_SECRET environment variable was unset or blank. An attacker with network access can forge valid JWT tokens using this hard-coded secret, bypassing authentication. The vulnerability is fixed in version 1.6.0 by generating a random per-process signing secret when environment variables are not configured.

Affected products

Topoteretes cognee up to 1.5.4

Timeline

2026-10-04: disclosed
2026-09-16: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.