Is CVE-2026-7844 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-7844 being exploited in the wild.

How severe is CVE-2026-7844?

Medium severity, with a CVSS score of 6.3, published 5 May 2026.

Which products and versions are affected?

Chatchat-Space Langchain-Chatchat up to 0.3.1.3.

Is there a fix for CVE-2026-7844?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-7844 attacked?

It is attacked from the adjacent network, in a software library.

Am I affected by CVE-2026-7844?

Check whether you run Chatchat-Space Langchain-Chatchat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-7844: chatchat-space Langchain-Chatchat missing authentication in file endpoints

CVE-2026-7844 · Severity: medium · CVSS 6.3 · Published 2026-05-05

Langchain-Chatchat, an application for building local knowledge bases with large language models, contains a security flaw in its file management service. This vulnerability allows unauthorized users on the same local network to list, read, or delete files without providing any credentials. This could lead to the exposure of sensitive documents or the disruption of the application's knowledge base.

Technologies: Chatchat-Space Langchain-Chatchat. Vendors: Chatchat-Space.

Quick answers

Is CVE-2026-7844 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-7844 being exploited in the wild.
How severe is CVE-2026-7844?: Medium severity, with a CVSS score of 6.3, published 5 May 2026.
Which products and versions are affected?: Chatchat-Space Langchain-Chatchat up to 0.3.1.3.
Is there a fix for CVE-2026-7844?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-7844 attacked?: It is attacked from the adjacent network, in a software library.
Am I affected by CVE-2026-7844?: Check whether you run Chatchat-Space Langchain-Chatchat at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A missing authentication vulnerability (CWE-306) exists in Langchain-Chatchat versions up to 0.3.1.3 within the 'Compatible File Service' component. The flaw is located in the 'openai_routes.py' file, specifically affecting the 'files/list_files', 'retrieve_file', 'retrieve_file_content', and 'delete_file' functions. An attacker with local network access can interact with these endpoints without authentication to list, download, or delete files stored within the application. While the project was notified via an issue report, no official patch has been confirmed at the time of this advisory.

Affected products

chatchat-space Langchain-Chatchat up to 0.3.1.3

Timeline

2026-04-13: disclosed: Issue reported to the project maintainers via GitHub issue #5465
2026-05-05: advisory: Vulnerability published in NVD and VulDB

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.