Threat Intelligence Database

Cognee versions prior to 1.2.0 have an improper access control vulnerability that allows unauthenticated attackers to overwrite the global LLM provider configuration. This occurs because the settings endpoint does not enforce admin or superuser checks. Exploiting this flaw, attackers can redirect all LLM operations to a malicious endpoint, potentially exfiltrating sensitive data such as prompts, uploaded documents, extracted entities, and knowledge graph content from all users. The vulnerability has a critical severity with a CVSS score of 9.3. No official patch or remediation guidance is currently available.