CVE-2026-58473: topoteretes Cognee improper access control in settings endpoint

CVE-2026-58473 · Severity: critical · CVSS 9.1 · Published 2026-07-07

Cognee is a platform for managing AI knowledge and LLM operations. This vulnerability allows any unauthenticated user to register a basic account and modify the global LLM configuration settings, which are used across all users and operations on the system. An attacker can redirect all AI language model queries to an attacker-controlled server, enabling them to intercept and steal sensitive data such as user prompts, uploaded documents, extracted entities, and knowledge graphs from all users on the instance.

Technologies: Topoteretes Cognee. Vendors: PyPI, Topoteretes.

Quick answers

Is CVE-2026-58473 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-58473 being exploited in the wild.
How severe is CVE-2026-58473?
Critical severity, with a CVSS score of 9.1, published 7 July 2026.
Which products and versions are affected?
cognee (PyPI) ECOSYSTEM:introduced=0,fixed=1.5.0; Topoteretes Cognee < 1.2.0, < 1.5.0.
Is there a fix for CVE-2026-58473?
Yes. cognee (PyPI): upgrade to 1.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-58473 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-58473?
Check whether you run cognee (PyPI) or Topoteretes Cognee at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • cognee (PyPI): upgrade to 1.5.0 or later
    pip install "cognee>=1.5.0"

Technical details

This vulnerability is rooted in CWE-306 (Missing Authentication for Critical Function), where the API settings endpoint fails to enforce role-based access control for critical configuration changes. The vulnerable component is the `/api/v1/settings` endpoint, which modifies process-wide singleton configuration that affects all LLM operations system-wide. An attacker with a self-registered (non-privileged) account can invoke this endpoint without authentication checks, overwriting the LLM provider URL to point to an attacker-controlled server. The attack vector is network-based with no required privileges or user interaction. The root cause is the absence of admin/superuser privilege validation before allowing configuration changes. Once exploited, all LLM operations on the instance—including prompt processing, document analysis, and entity extraction—are redirected through the attacker's endpoint, enabling full interception of sensitive data. The vulnerability was patched in version 1.5.0, with notable fixes in commits d10b1b7, 10971db, and ebcf824.

Affected products

  • topoteretes cognee < 1.5.0

Identifiers

  • CVE-2026-58473
  • GHSA-49f7-whx5-4256
  • PYSEC-2026-3816

Timeline

  • 2026-07-07: disclosed
  • 2026-07-07: patched: Published to NVD; patched in version 1.5.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.