CVE-2026-57476: Deloitte AI Assist Auth Bypass Vulnerability

CVE-2026-57476 Overview

CVE-2026-57476 affects Deloitte AI Assist for Customer, a customer-facing generative AI assistant. The product exposed unauthenticated API endpoints that permitted reading from and writing to the retrieval-augmented generation (RAG) corpus. An attacker with knowledge of the required parameters could exfiltrate corpus content or inject poisoned data used to ground AI responses. Deloitte restricted network access and enforced authentication on the affected endpoints on 2026-03-25. The weakness is categorized as Missing Authentication for Critical Function [CWE-306].

Critical Impact
Unauthenticated attackers over the network could read confidential RAG content and inject adversarial documents that manipulate downstream AI-generated answers delivered to customers.

Affected Products

Deloitte AI Assist for Customer (all versions prior to the 2026-03-25 remediation)
Deployments exposing the pre-remediation API endpoints to untrusted networks
Integrations that consumed responses grounded on the affected RAG corpus

Discovery Timeline

2026-03-25 - Deloitte restricted network access and enforced authentication on the affected endpoints
2026-07-10 - CVE-2026-57476 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-57476

Vulnerability Analysis

Deloitte AI Assist for Customer exposed API endpoints that performed sensitive operations against a retrieval-augmented generation (RAG) corpus without requiring authentication. The corpus stores the documents and embeddings the assistant retrieves to ground its responses. An attacker who discovered the correct parameter names and identifiers could invoke these endpoints directly from the network. The vulnerability enables two distinct outcomes: unauthorized reading of corpus content and unauthorized injection of new content into the corpus. Injected content is later retrieved and incorporated into AI responses, producing an indirect prompt injection and data poisoning primitive. The attack requires no user interaction and no privileges on the target system.

Root Cause

The root cause is Missing Authentication for Critical Function [CWE-306]. The affected endpoints performed corpus read and write operations without validating a caller identity or authorization scope. Network exposure of these endpoints compounded the issue by making them reachable to any client that could resolve the service.

Attack Vector

Exploitation occurs over the network against the exposed API. An attacker enumerates or guesses the parameter names and corpus identifiers, then issues direct HTTP requests to the vulnerable endpoints. Read operations return corpus documents. Write operations insert attacker-controlled content that subsequent RAG queries will surface as authoritative context to the language model.

No verified proof-of-concept code has been published. Refer to the Zero Tolerance Advisory VU487875 and the CISA CSAF Document for technical detail.

Detection Methods for CVE-2026-57476

Indicators of Compromise

Unauthenticated HTTP requests to AI Assist for Customer API endpoints originating from external or non-allowlisted networks prior to 2026-03-25.
Unexpected write operations against the RAG corpus, including new documents with unfamiliar authorship, timestamps, or embeddings.
Anomalous AI responses referencing content not present in vetted source material, indicating possible corpus poisoning.

Detection Strategies

Review API gateway and application logs for endpoint invocations lacking authentication headers or bearer tokens.
Diff the current RAG corpus against a known-good snapshot to identify inserted or modified documents.
Alert on high-volume enumeration patterns against corpus-related endpoints, such as sequential parameter fuzzing.

Monitoring Recommendations

Ingest AI application, API gateway, and network flow logs into a centralized analytics platform for correlation.
Baseline normal RAG write activity and alert on off-hours or high-cardinality insertions.
Track downstream user reports of hallucinated or off-policy AI responses as a signal of possible corpus tampering.

How to Mitigate CVE-2026-57476

Immediate Actions Required

Confirm the deployed AI Assist for Customer service is running the post-2026-03-25 remediated build with authentication enforced.
Restrict network reachability to corpus API endpoints using allowlists, private networking, or a reverse proxy that enforces authentication.
Audit the RAG corpus for injected content and remove documents that cannot be attributed to a legitimate ingestion pipeline.

Patch Information

Deloitte remediated the exposure on 2026-03-25 by restricting network access and enforcing authentication on the previously exposed endpoints. Customers using the managed service receive the fix automatically. Refer to the Zero Tolerance Advisory and the associated CVE record for coordinated details.

Workarounds

Place the API behind a gateway that requires signed tokens for every corpus read and write.
Segment the RAG service into a private subnet and disallow direct ingress from the public internet.
Enable write-side validation, such as content provenance checks and moderation, before documents are committed to the corpus.

bash

# Configuration example: enforce authentication and network restriction at the gateway
# Deny unauthenticated access to RAG corpus endpoints
location /api/rag/ {
    allow 10.0.0.0/8;
    deny all;
    auth_request /_auth;
    proxy_pass http://ai_assist_backend;
}