CVE-2026-21484: Mintplex-Labs anything-llm · Observable Discrepancy
Affects Mintplex-Labs anything-llmSource CVE Database V5
Not known to be exploited · public detection template (Nuclei) · CVSS 5.3 Medium.
Data as of 26 Oct 2026, 08:30 UTC
- EPSS
- 0.7% chance of exploitation in 30 days – higher than 55% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 3 Jan 2026
Detectable: evidence found.
nuclei template: AnythingLLM - Username Enumeration via Password Recovery
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Mintplex-Labsanything-llm | Affected
| Fixed in– |
AI-suggested
European organizations using anything-llm should immediately update to versions including or beyond commit e287fab56089cf8fcea9ba579a3ecdeca0daa313 to eliminate the username enumeration vulnerability. Beyond patching, organizations should implement rate limiting and monitoring on password recovery endpoints to detect and block enumeration attempts. Employing multi-factor authentication (MFA) reduces the risk posed by username enumeration by adding an additional verification layer. Security teams should audit logs for unusual password recovery requests and implement alerting for suspicious patterns. User education on phishing risks and secure password practices is also critical. Where possible, consider customizing error messages uniformly across authentication endpoints to avoid information leakage. Finally, conduct regular security assessments and penetration testing to identify similar information disclosure issues proactively.
Description
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to commit e287fab56089cf8fcea9ba579a3ecdeca0daa313, the password recovery endpoint returns different error messages depending on whether a username exists, so enabling username enumeration. Commit e287fab56089cf8fcea9ba579a3ecdeca0daa313 fixes this issue.