CVE-2026-32617 - Vulnerability Analysis

Overview

AnythingLLM <= 1.11.1 contains an authentication bypass caused by missing password or API key configuration and permissive CORS policy, letting local network attackers access all HTTP endpoints and WebSocket, exploit requires attacker to be on the same LAN.

Severity & Score

Impact

Local network attackers can access all endpoints without authentication, potentially leading to unauthorized data access or control.

Mitigation

Configure a password or API key and restrict CORS policy; update to the latest version.

References

• https://github.com/Mintplex-Labs/anything-llm/security/advisories/GHSA-24qj-pw4h-3jmm

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner