CVE-2026-5632
Published: 06 April 2026
Summary
CVE-2026-5632 is a medium-severity Improper Authentication (CWE-287) vulnerability. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 29.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
This vulnerability is AI-related — categorised as AI Agent Protocols and Integrations; in the Supply Chain and Deployment risk domain.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2026-5632 is a missing authentication vulnerability affecting versions of assafelovic/gpt-researcher up to 3.4.3. The issue resides in an unknown function within the HTTP REST API endpoint, classified under CWE-287 (Improper Authentication) and CWE-306 (Missing Authentication for Critical Function). It carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L), indicating high severity due to its network accessibility and lack of prerequisites.
Remote attackers require no privileges or user interaction to exploit this vulnerability by manipulating the affected endpoint. Successful exploitation grants low-level impacts on confidentiality, integrity, and availability, potentially allowing unauthorized access or disruption of the API's functions.
Advisories from VulDB (vuln/355420) note that the project was informed early via GitHub issue #1695 but has not responded or issued patches. No mitigations or fixes are currently available; practitioners should restrict network access to the HTTP REST API endpoint until resolution.
The exploit is publicly available, increasing the risk of immediate abuse. As an AI-powered research tool leveraging GPT models, this vulnerability may expose sensitive research workflows in deployments.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-19188
Vulnerability details
A vulnerability was found in assafelovic gpt-researcher up to 3.4.3. This impacts an unknown function of the component HTTP REST API Endpoint. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely. The exploit has…
more
been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
- CWE(s)
AI Security AnalysisAI
- AI Category
- AI Agent Protocols and Integrations
- Risk Domain
- Supply Chain and Deployment
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Matched keywords: gpt
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing authentication on public-facing HTTP REST API endpoint (CWE-287/306) directly enables remote exploitation without credentials or interaction, mapping to T1190 Exploit Public-Facing Application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly identifies and rejects unauthorized actions without identification or authentication on the vulnerable HTTP REST API endpoint.
Enforces approved authorizations for access to the API endpoint, mitigating the missing authentication vulnerability.
Monitors and controls communications at system boundaries to restrict remote access to the unauthenticated API endpoint.