Deloitte AI Assist for Customer had a vulnerability (CVE-2026-57474) involving the exposure of configuration information through unauthenticated public API endpoints. This information disclosure falls under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The exposed data could reduce attacker reconnaissance effort but does not directly impact confidentiality, integrity, or availability beyond that. On 2026-03-25, Deloitte mitigated the issue by restricting network access and requiring authentication for the affected endpoints. There is no explicit vendor advisory or patch information beyond this mitigation.

The vulnerability allows unauthorized actors to access certain configuration information via public API endpoints without authentication. This information disclosure could facilitate attacker reconnaissance but does not directly lead to data modification or service disruption. The CVSS 3.1 base score is 5.3 (medium), reflecting the limited confidentiality impact and no integrity or availability impact.

Deloitte has already restricted network access and enforced authentication on the previously exposed API endpoints as of 2026-03-25. No further action is explicitly stated. Patch status is not confirmed; check Deloitte advisories for updates. Since the service is not cloud-hosted, remediation depends on applying these access restrictions.