CVE-2026-105141

A security flaw has been discovered in topoteretes cognee up to 1.5.4. The affected element is the function getuseridbyemail of the file cognee/modules/users/authentication/getapiauthbackend.py of the component JWT Signing Key Handler. The manipulation of the argument FASTAPIUSERSJWTSECRET result...

CVE-2026-105141 topoteretes cognee JWT Signing Key get_api_auth_backend.py get_user_id_by_email hard-coded credentials

A security flaw has been discovered in topoteretes cognee up to 1.5.4. The affected element is the function getuseridbyemail of the file cognee/modules/users/authentication/getapiauthbackend.py of the component JWT Signing Key Handler. The manipulation of the argument FASTAPIUSERSJWTSECRET result...

CVE-2026-105141

A security flaw has been discovered in topoteretes cognee up to 1.5.4. The affected element is the function getuseridbyemail of the file cognee/modules/users/authentication/getapiauthbackend.py of the component JWT Signing Key Handler. The manipulation of the argument FASTAPIUSERSJWTSECRET result...

cognee-community-graph-adapter-arcadedb (0.2.0), cognee-community-graph-adapter-memgraph (0.2.0) +25 more potentially affected by CVE-2026-105141 via cognee (>=1.0.3, <=1.5.4)

cognee PYPI version =1.0.3, =1.5.4 is affected by a known vulnerability. The following packages have a transitive dependency on cognee and may be impacted: - cognee-community-graph-adapter-arcadedb 0.2.0 - cognee-community-graph-adapter-memgraph 0.2.0 - cognee-community-graph-adapter-networkx 1.1...

CVE-2026-105141 topoteretes cognee JWT Signing Key get_api_auth_backend.py get_user_id_by_email hard-coded credentials

A security flaw has been discovered in topoteretes cognee up to 1.5.4. The affected element is the function getuseridbyemail of the file cognee/modules/users/authentication/getapiauthbackend.py of the component JWT Signing Key Handler. The manipulation of the argument FASTAPIUSERSJWTSECRET result...

EUVD-2026-92086

A security flaw has been discovered in topoteretes cognee up to 1.5.4. The affected element is the function getuseridbyemail of the file cognee/modules/users/authentication/getapiauthbackend.py of the component JWT Signing Key Handler. The manipulation of the argument FASTAPIUSERSJWTSECRET result...

CVE-2026-105141 topoteretes cognee JWT Signing Key get_api_auth_backend.py get_user_id_by_email hard-coded credentials

A security flaw has been discovered in topoteretes cognee up to 1.5.4. The affected element is the function getuseridbyemail of the file cognee/modules/users/authentication/getapiauthbackend.py of the component JWT Signing Key Handler. The manipulation of the argument FASTAPIUSERSJWTSECRET result...

CVE-2026-105141

The topoteretes cognee software (versions up to 1.5.4 ) contains a security flaw in the JWT Signing Key Handler component. Specifically, the get_user_id_by_email function within the file cognee/modules/users/authentication/get_api_auth_backend.py allows for the manipulation of the FASTAPI_USERS_J...

PT-2026-104617

A security flaw has been discovered in topoteretes cognee up to 1.5.4. The affected element is the function get user id by email of the file cognee/modules/users/authentication/get api auth backend.py of the component JWT Signing Key Handler. The manipulation of the argument FASTAPI USERS JWT...

CVE-2026-105141: Use of Hard-coded Credentials

A security flaw has been discovered in topoteretes cognee up to 1.5.4. The affected element is the function getuseridbyemail of the file cognee/modules/users/authentication/getapiauthbackend.py of the component JWT Signing Key Handler. The manipulation of the argument FASTAPIUSERSJWTSECRET result...

cognee-agensgraph (0.2.0) potentially affected by CVE-2026-58473 via cognee (0.5.8)

cognee PYPI version 0.5.8 is affected by a known vulnerability. The following packages have a transitive dependency on cognee and may be impacted: - cognee-agensgraph 0.2.0 Source cves: CVE-2026-58473 Source advisory: OSV:PYSEC-2026-3816...

cognee-community-hybrid-adapter-duckdb (>=0.1.2, <=0.1.3), cognee-community-hybrid-adapter-falkor (0.2.1) +11 more potentially affected by CVE-2026-58473 via cognee (0.5.2)

cognee PYPI version 0.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on cognee and may be impacted: - cognee-community-hybrid-adapter-duckdb =0.1.2, =0.1.1, =0.1.1, =0.1.1, =0.1.2 - cognee-community-tasks-scrapegraph 0.1.0 -...

cognee-community-hybrid-adapter-falkor (0.2.0), cognee-community-vector-adapter-qdrant (0.2.0) potentially affected by CVE-2026-58473 via cognee (0.5.1)

cognee PYPI version 0.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on cognee and may be impacted: - cognee-community-hybrid-adapter-falkor 0.2.0 - cognee-community-vector-adapter-qdrant 0.2.0 Source cves: CVE-2026-58473 Source advisory:...

cognee-integration-crewai (0.1.0) potentially affected by CVE-2026-58473 via cognee (0.3.4)

cognee PYPI version 0.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on cognee and may be impacted: - cognee-integration-crewai 0.1.0 Source cves: CVE-2026-58473 Source advisory: OSV:PYSEC-2026-3816...

cognee-agensgraph (>=0.3.0, <=0.3.1) potentially affected by CVE-2026-58473 via cognee (0.2.4)

cognee PYPI version 0.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on cognee and may be impacted: - cognee-agensgraph =0.3.0, =0.3.1 Source cves: CVE-2026-58473 Source advisory: OSV:PYSEC-2026-3816...

langchain-cognee (0.1.0) potentially affected by CVE-2026-58473 via cognee (0.1.44)

cognee PYPI version 0.1.44 is affected by a known vulnerability. The following packages have a transitive dependency on cognee and may be impacted: - langchain-cognee 0.1.0 Source cves: CVE-2026-58473 Source advisory: OSV:PYSEC-2026-3816...

Cognee allows non-superusers to overwrite global LLM configuration

Cognee before 1.2.0 contains an improper access control vulnerability that allows unauthenticated attackers to overwrite the global LLM provider configuration by self-registering an account and calling the settings endpoint, which performs no admin or superuser check. Attackers can redirect all L...

PYSEC-2026-3816 Cognee allows non-superusers to overwrite global LLM configuration

Cognee before 1.2.0 contains an improper access control vulnerability that allows unauthenticated attackers to overwrite the global LLM provider configuration by self-registering an account and calling the settings endpoint, which performs no admin or superuser check. Attackers can redirect all L...

cognee-community-graph-adapter-arcadedb (0.2.0), cognee-community-graph-adapter-memgraph (0.2.0) +25 more potentially affected by CVE-2026-58473 via cognee (>=1.0.3, <=1.4.2)

cognee PYPI version =1.0.3, =1.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on cognee and may be impacted: - cognee-community-graph-adapter-arcadedb 0.2.0 - cognee-community-graph-adapter-memgraph 0.2.0 - cognee-community-graph-adapter-networkx 1.1...

cognee-community-graph-adapter-memgraph (0.1.3), cognee-community-graph-adapter-networkx (1.0.2) +16 more potentially affected by CVE-2026-58473 via cognee (0.5.3)

cognee PYPI version 0.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on cognee and may be impacted: - cognee-community-graph-adapter-memgraph 0.1.3 - cognee-community-graph-adapter-networkx 1.0.2 - cognee-community-graph-adapter-spanner 0.1.0 -...