CVE-2026-105141
MediumCVSS 6.3Summary
A security flaw has been discovered in topoteretes cognee up to 1.5.4 in the get_user_id_by_email function of cognee/modules/users/authentication/get_api_auth_backend.py, part of the JWT Signing Key Handler component. Manipulation of the FASTAPI_USERS_JWT_SECRET argument results in hard-coded credentials. The attack can be launched remotely.
Risk Assessment
A remote attacker may exploit hard-coded credentials to gain unauthorized access. This could lead to account takeover or privilege escalation.
Recommendation
Upgrade cognee to version 1.6.0 or later, which includes patch fa65fc0cd86cdba48d19aa76e36be862be982f5d. Upgrading the affected component is advised.
Other vulnerabilities in cognee
See all- CVE-2026-58473Critical
Cognee before version 1.2.0 contains an improper access control vulnerability that allows unauthenticated attackers to overwrite the global LLM provider configuration by self-registering an account and calling the settings endpoint, which performs no admin or superuser check. Attackers can redirect all LLM operations instance-wide to an attacker-controlled endpoint by exploiting the process-wide singleton configuration cache, enabling exfiltration of prompts, uploaded documents, extracted entities, and knowledge graph content from all users.
- CVE-2026-31231Critical
Cognee up to version 0.4.0 contains a critical remote code execution vulnerability in its notebook cell execution API endpoint. The endpoint executes arbitrary Python code provided by the user using the unsafe exec() function without any sandboxing, validation, or security controls.
Original NVD description (English source)
A security flaw has been discovered in topoteretes cognee up to 1.5.4. The affected element is the function get_user_id_by_email of the file cognee/modules/users/authentication/get_api_auth_backend.py of the component JWT Signing Key Handler. The manipulation of the argument FASTAPI_USERS_JWT_SECRET results in hard-coded credentials. The attack may be launched remotely. Upgrading to version 1.6.0 is sufficient to fix this issue. The patch is identified as fa65fc0cd86cdba48d19aa76e36be862be982f5d. Upgrading the affected component is advised.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS