Is CVE-2026-1114 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-1114 being exploited in the wild.

How severe is CVE-2026-1114?

Critical severity, with a CVSS score of 9.8, published 7 April 2026.

Which products and versions are affected?

lollms (PyPI) ECOSYSTEM:introduced=0,fixed=2.2.0, ECOSYSTEM:introduced=0,last_affected=2.1.0.

Is there a fix for CVE-2026-1114?

Yes. lollms (PyPI): upgrade to 2.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-1114 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-1114?

Check whether you run Lollms or lollms (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-1114: ParisNeo LoLLMs privilege escalation via weak JWT secret key

CVE-2026-1114 · Severity: critical · CVSS 9.8 · Published 2026-04-07

LoLLMs, a tool for interfacing with Large Language Models, is vulnerable to a security flaw in how it manages user sessions. The application uses a weak secret key to sign security tokens, which allows an attacker to guess the key and create their own administrative credentials. If exploited, an unauthorized person could take full control of the system, access restricted data, and impersonate administrators.

Technologies: Lollms, lollms (PyPI). Vendors: Lollms, PyPI.

Quick answers

Is CVE-2026-1114 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-1114 being exploited in the wild.
How severe is CVE-2026-1114?: Critical severity, with a CVSS score of 9.8, published 7 April 2026.
Which products and versions are affected?: lollms (PyPI) ECOSYSTEM:introduced=0,fixed=2.2.0, ECOSYSTEM:introduced=0,last_affected=2.1.0.
Is there a fix for CVE-2026-1114?: Yes. lollms (PyPI): upgrade to 2.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-1114 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-1114?: Check whether you run Lollms or lollms (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

lollms (PyPI): upgrade to 2.2.0 or later
```
pip install "lollms>=2.2.0"
```

Technical details

LoLLMs version 2.1.0 and earlier utilizes a weak, predictable secret key for signing JSON Web Tokens (JWT) used in session management. This allows a remote, unauthenticated attacker to perform an offline brute-force attack to recover the secret key. Once recovered, the attacker can forge JWTs with administrative claims, leading to full privilege escalation and unauthorized access to restricted API endpoints. The vulnerability is addressed in version 2.2.0, which implements automatic rotation for weak or missing secret keys.

Affected products

parisneo lollms < 2.2.0

Identifiers

CVE-2026-1114
GHSA-9296-v3fr-j92j
PYSEC-2026-170

Timeline

2026-04-07: advisory: GitHub Advisory published
2026-04-07: disclosed: NVD publication date
2026-01-17: patched: Fix committed to repository

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.