Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2026-24477 is a high-severity Insertion of Sensitive Information Into Sent Data (CWE-201) vulnerability in Mintplexlabs Anythingllm. Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Network Sniffing (T1040); ranked in the top 27% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
This vulnerability is AI-related — categorised as LLM Application Platforms; in the Privacy and Disclosure risk domain.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-4 (Information Flow Enforcement) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
AnythingLLM versions prior to 1.10.0 expose the QdrantApiKey in plaintext through the unauthenticated /api/setup-complete endpoint when the application is configured to use Qdrant as its vector database. The affected component is the setup status endpoint in this open-source LLM orchestration tool that manages retrieval-augmented generation workflows. The flaw is tracked as CWE-201 and carries a CVSS 4.0 score of 8.7.
An unauthenticated remote attacker can retrieve the API key and obtain full read/write access to the Qdrant instance. Because Qdrant stores the core knowledge base for semantic search, the attacker can extract or alter embedded documents, thereby compromising the retrieval functionality and indirectly disclosing any confidential content that users have uploaded into AnythingLLM.
The referenced GitHub Security Advisory GHSA-gm94-qc2p-xcwf states that the issue is resolved in version 1.10.0, which prevents the key from being returned by the endpoint.
The EPSS score rose from a low baseline to a peak of 0.1400 (current value 0.1041), indicating increased exploitation interest after disclosure. The vulnerability is directly relevant to AI/ML deployments that rely on AnythingLLM for RAG over private corpora.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-4732
Vulnerability Data
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. If AnythingLLM prior to version 1.10.0 is configured to use Qdrant as the vector database with an API key, this…
more
QdrantApiKey could be exposed in plain text to unauthenticated users via the `/api/setup-complete` endpoint. Leakage of QdrantApiKey allows an unauthenticated attacker full read/write access to the Qdrant vector database instance used by AnythingLLM. Since Qdrant often stores the core knowledge base for RAG in AnythingLLM, this can lead to complete compromise of the semantic search / retrieval functionality and indirect leakage of confidential uploaded documents. Version 1.10.0 patches the issue.
- CWE(s)
AI Security AnalysisAI
- AI Category
- LLM Application Platforms
- Risk Domain
- Privacy and Disclosure
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Matched keywords: anythingllm, llm, qdrant
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 1 hardening rule · 1 OS baseline
V14.2.3
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces policy-based information flow rules that block transmission of sensitive data to unauthorized actors.
Enforces authorizations on logical access so that sensitive data is not released to unauthorized recipients.
Requires validation of outbound information to ensure sensitive content is not disclosed in responses or messages.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent insertion of sensitive data into application outputs and messages.
Monitoring runtime data flows and outputs can detect sensitive data being transmitted.
Protecting data-in-transit can include filtering or encrypting to avoid exposing sensitive content.
Protecting data-in-use includes removing confidential values before they are processed or sent.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Data-masking techniques can prevent sensitive values from appearing in transmitted payloads.
Classification identifies sensitive data so it is not inadvertently transmitted.
Labelling makes sensitive data visible to developers and prevents accidental inclusion in outbound messages.
Information-transfer rules directly govern what data may be sent to external parties.
PII-protection requirements reduce the chance of sending personal data to unauthorized recipients.
DLP controls inspect and block outbound flows that contain sensitive information.