Is CVE-2026-5632 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-5632 being exploited in the wild.

How severe is CVE-2026-5632?

High severity, with a CVSS score of 7.3, published 6 April 2026.

Which products and versions are affected?

Assaf Elovic GPT Researcher <= 3.4.3.

Is there a fix for CVE-2026-5632?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-5632 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-5632?

Check whether you run Assaf Elovic GPT Researcher at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-5632: assafelovic gpt-researcher missing authentication in REST API and WebSockets

Q: Is there a fix for CVE-2026-5632?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-5632 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-5632?

Check whether you run Assaf Elovic GPT Researcher at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-5632 · Severity: high · CVSS 7.3 · Published 2026-04-06

GPT Researcher, an autonomous AI research agent, contains a critical security flaw where its web interface and API are completely unprotected. This allows anyone on the network to remotely access the tool without a password to read private research reports, upload or delete files, and trigger expensive AI tasks that consume the owner's API credits. Because the application lacks any built-in login system, an attacker could effectively take over the service and its data.

Technologies: Assaf Elovic GPT Researcher. Vendors: Assaf Elovic.

Quick answers

Is CVE-2026-5632 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-5632 being exploited in the wild.
How severe is CVE-2026-5632?: High severity, with a CVSS score of 7.3, published 6 April 2026.
Which products and versions are affected?: Assaf Elovic GPT Researcher <= 3.4.3.
Is there a fix for CVE-2026-5632?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-5632 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-5632?: Check whether you run Assaf Elovic GPT Researcher at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The FastAPI-based backend of gpt-researcher (specifically in backend/server/app.py) fails to implement any authentication middleware, API key validation, or session management. This architectural omission exposes 14 critical endpoints, including those for file uploads, file deletion, and research task generation. A remote attacker can exploit this to exfiltrate research data, perform arbitrary file operations, or cause financial impact by triggering unlimited LLM API calls. The vulnerability is present in the default configuration, which binds to all network interfaces (0.0.0.0). As of the advisory date, the project has not released a patch, and the application lacks any internal authentication constructs.

Affected products

assafelovic gpt-researcher <= 3.4.3

Timeline

2026-03-19: disclosed: Vulnerability discovered and reported via GitHub issue #1695
2026-04-06: advisory: Initial CVE publication

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.