CVE-2025-61164 Overview
CVE-2025-61164 is an information disclosure vulnerability affecting Cohere North AI version 1.1.5. The flaw resides in the product's WebSocket endpoint, which exposes sensitive data to unauthorized observers. Cohere North is an enterprise AI platform used to connect large language models to internal data and workflows. Any weakness that leaks data from such a platform can expose proprietary content, user prompts, or session context. The vulnerability was published to the National Vulnerability Database on 2026-08-26.
Critical Impact
The WebSocket endpoint in Cohere North AI v1.1.5 leaks information that should remain protected, potentially exposing enterprise AI session data to unauthorized parties.
Affected Products
- Cohere North AI v1.1.5
Discovery Timeline
- 2026-08-26 - CVE-2025-61164 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2025-61164
Vulnerability Analysis
CVE-2025-61164 is classified as an information disclosure issue in Cohere North AI v1.1.5. The vulnerability exists in the WebSocket endpoint that the platform uses for real-time communication between clients and the AI backend. WebSocket connections in AI platforms typically carry model prompts, responses, session identifiers, and metadata about the underlying environment. When such a channel discloses information beyond what the consumer should see, attackers gain visibility into internal state, other users' data, or configuration details.
Public technical details are limited. Reviewers should consult the GitHub advisory for CVE-2025-61164 for the researcher-authored writeup and the Cohere North product overview for platform context.
Root Cause
The root cause is improper handling of data returned over the WebSocket endpoint in v1.1.5. The endpoint returns information that should be restricted, indicating missing authorization checks, weak session scoping, or overly verbose server responses. No CWE identifier is assigned in the current NVD record.
Attack Vector
An attacker interacts with the WebSocket endpoint exposed by Cohere North AI v1.1.5 and observes responses that contain information they should not receive. The exact preconditions, such as whether authentication is required, are not documented in the NVD entry. Refer to the linked GitHub advisory for the researcher's reproduction steps.
No verified proof-of-concept code is available in the enriched data. Refer to the external references for technical details rather than synthesized examples.
Detection Methods for CVE-2025-61164
Indicators of Compromise
- Unexpected WebSocket client connections to the Cohere North AI service from untrusted networks or unknown user agents.
- Anomalous volumes of outbound data from the WebSocket endpoint that do not match legitimate session patterns.
- Repeated WebSocket handshake attempts against /ws or comparable Cohere North paths outside normal business workflows.
Detection Strategies
- Enable verbose access logging on the reverse proxy or ingress fronting Cohere North and inspect WebSocket upgrade requests for unauthenticated or unusual clients.
- Correlate WebSocket session identifiers with authenticated user sessions to detect cross-session data exposure.
- Perform passive traffic inspection in a controlled environment to confirm what fields the endpoint returns in v1.1.5.
Monitoring Recommendations
- Forward application and proxy logs to a centralized analytics platform and alert on WebSocket sessions that transfer atypical volumes of response data.
- Baseline normal WebSocket traffic patterns for the Cohere North deployment and alert on deviations.
- Monitor for authentication failures followed by successful WebSocket upgrades, which can indicate probing.
How to Mitigate CVE-2025-61164
Immediate Actions Required
- Inventory all Cohere North AI deployments and identify any running v1.1.5.
- Restrict network exposure of the WebSocket endpoint to trusted internal clients only until a fixed version is confirmed.
- Contact Cohere support for guidance on a patched release and recommended upgrade path.
Patch Information
The enriched CVE data does not list a vendor advisory URL or fixed version. Track the GitHub advisory for CVE-2025-61164 and vendor communications from Cohere for patch availability.
Workarounds
- Place the Cohere North WebSocket endpoint behind an authenticated reverse proxy that enforces per-user authorization on upgrade requests.
- Terminate WebSocket connections at a gateway that filters or redacts sensitive fields from server responses.
- Segment the Cohere North service so only vetted application backends, not end-user browsers on untrusted networks, can reach the WebSocket endpoint.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
