CVE-2026-105141 json
topoteretes cognee JWT Signing Key get_api_auth_backend.py get_user_id_by_email hard-coded credentials
published 2026-10-04 35 d ago modified 2026-10-06 33 d ago also EUVD-2026-92086
- cvss
- 6.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 28%
- public exploits
- 0
- none known
Summary
A security flaw has been discovered in topoteretes cognee up to 1.5.4. The affected element is the function get_user_id_by_email of the file cognee/modules/users/authentication/get_api_auth_backend.py of the component JWT Signing Key Handler. The manipulation of the argument FASTAPI_USERS_JWT_SECRET results in hard-coded credentials. The attack may be launched remotely. Upgrading to version 1.6.0 is sufficient to fix this issue. The patch is identified as fa65fc0cd86cdba48d19aa76e36be862be982f5d. Upgrading the affected component is advised.
Patch / fix
- topoteretes cognee 1.6.0
- github.com/topoteretes/cognee@fa65fc0 commit
- github.com/topoteretes/cognee#5062 pull request
- github.com/topoteretes/cognee/releases/tag/v1.6.0 release
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 34 d ago
Exploit prediction
0.34% chance of exploitation in the next 30 days, higher than 28% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X |
| CNA | 3.1 | 6.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C |
| CNA | 3.0 | 6.3 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C |
| CNA | 2.0 | 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C |
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| CNA | 3.1 | 6.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
| CNA | 2.0 | 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P |
Affected products
- topoteretes cognee
Classification
References
-
github.com
/topoteretes/cognee/pull/5062
issue-tracking, patch
-
github.com
/topoteretes/cognee/commit/fa65fc0cd86cdba48d19aa76e36be862be982f5d
patch
-
github.com
/topoteretes/cognee/releases/tag/v1.6.0
patch
-
vuldb.com
/vuln/413365
vdb-entry, technical-description
-
vuldb.com
/vuln/413365/cti
signature, permissions-required
-
vuldb.com
/cve/CVE-2026-105141
third-party-advisory
-
vuldb.com
/submit/944531
third-party-advisory
-
linear.app
/cognee/issue/SDK-720/replace-the-super-secret-fallback-for-token-signing-secrets-with-a-per
issue-tracking
-
github.com
/topoteretes/cognee/
product
Sources
- CVE List CVE-2026-105141
- NVD CVE-2026-105141
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.