CVE-2026-57476
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
Deloitte AI Assist for Customer exposed unauthenticated API endpoints that allowed an attacker with knowledge of additional parameters to read from or inject content into the RAG corpus. On 2026-03-25, network access was restricted and authentication was enforced for the previously exposed endpoints.
Risk Assessment
An attacker could read or modify data in the RAG corpus, potentially leading to leakage of sensitive information or manipulation of system responses.
Recommendation
Update Deloitte AI Assist for Customer to the latest version that enforces authentication for all API endpoints.
Other vulnerabilities in Deloitte AI Assist for Customer
See all- CVE-2026-57475Medium
Deloitte AI Assist for Customer accepted unauthenticated POST requests through public API endpoints, allowing a remote attacker to make limited configuration changes. These changes were not used by the system. Since 2026-03-25, network access has been restricted and authentication enforced.
- CVE-2026-57474Medium
Deloitte AI Assist for Customer exposed configuration information through public API endpoints that accepted unauthenticated requests. This information could reduce an attacker's reconnaissance effort. As of 2026-03-25, network access was restricted and authentication enforced.
Original NVD description (English source)
Deloitte AI Assist for Customer exposed unauthenticated API endpoints that allowed an attacker with knowledge of additional parameters to read from or inject content into the retrieval-augmented generation (RAG) corpus. On 2026-03-25, AI Assist for Customer restricted network access and enforced authentication for the previously exposed endpoints.