CVE-2026-58473: Cognee Authentication Bypass Vulnerability

CVE-2026-58473 Overview

Cognee versions before 1.2.0 contain an improper access control vulnerability [CWE-306] in the settings API. The /api/v1/settings endpoint performs no administrator or superuser check, allowing any authenticated user to overwrite the global Large Language Model (LLM) provider configuration. Combined with public self-registration enabled by default, unauthenticated attackers can register an account and redirect all LLM operations instance-wide to an attacker-controlled endpoint. This exposes prompts, uploaded documents, extracted entities, and knowledge graph content from every user on the instance.

Critical Impact
Attackers can hijack the process-wide LLM configuration cache to exfiltrate all AI-processed data across every tenant of a Cognee instance.

Affected Products

Cognee versions prior to 1.2.0
Cognee deployments with default public registration enabled
Cognee instances exposing the /api/v1/settings endpoint

Discovery Timeline

2026-07-07 - CVE-2026-58473 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-58473

Vulnerability Analysis

Cognee is a memory and knowledge graph framework for AI agents that delegates LLM operations to configurable providers. The settings router at cognee/api/v1/settings/routers/get_settings_router.py exposes an endpoint that mutates global LLM provider configuration. The route enforces authentication but omits authorization checks, meaning any registered user can modify instance-wide settings.

The configuration is held in a process-wide singleton cache. When an attacker overwrites the LLM provider URL and API key, all subsequent LLM calls from every user route through the attacker's endpoint. This includes prompts, document ingestion, entity extraction, and knowledge graph queries.

Public user registration is enabled by default via the register router. The combination of open registration and missing authorization on the settings endpoint converts a design flaw into an unauthenticated remote data exfiltration vector.

Root Cause

The root cause is missing authorization [CWE-306] on a privileged administrative endpoint. The handler accepts an authenticated user object but never validates user.is_superuser before persisting new LLM or vector database configuration. Separately, the FastAPI users registration router is mounted unconditionally, allowing arbitrary account creation without operator opt-in.

Attack Vector

An attacker reaches the target Cognee instance over the network, submits a POST to the registration endpoint to create an account, authenticates, then issues a PUT or POST to /api/v1/settings with a malicious llm configuration object. The singleton cache propagates the change to all workers, and every subsequent LLM invocation from any user is proxied through the attacker's endpoint.

python

# Security patch in cognee/api/v1/settings/routers/get_settings_router.py
## Error Codes
- **400 Bad Request**: Invalid settings provided
+ - **403 Forbidden**: User is not a superuser
- **500 Internal Server Error**: Error saving settings
"""
+ if not user.is_superuser:
+     from fastapi import HTTPException
+     raise HTTPException(status_code=403, detail="Only superusers can modify global settings.")
+
from cognee.modules.settings import save_llm_config, save_vector_db_config

if new_settings.llm is not None:

Source: GitHub Commit d10b1b7

The patch adds a superuser check to the settings handler and gates the registration router behind the COGNEE_PUBLIC_REGISTRATION_ENABLED environment variable.

Detection Methods for CVE-2026-58473

Indicators of Compromise

Unexpected POST or PUT requests to /api/v1/settings from non-administrator accounts.
New account creations against /auth/register shortly followed by settings modifications.
Outbound LLM API traffic to unfamiliar hostnames or IP addresses instead of the configured provider such as OpenAI, Anthropic, or Azure.
Changes to llm_provider, llm_endpoint, or llm_api_key values in the Cognee configuration store.

Detection Strategies

Audit application logs for /api/v1/settings mutations correlated to non-superuser identifiers.
Baseline expected LLM egress destinations and alert on deviation from that allowlist.
Monitor account creation velocity against the registration endpoint for anomalous bursts.

Monitoring Recommendations

Enable structured request logging on the Cognee FastAPI application, capturing user identity, endpoint, and payload hashes.
Forward egress network telemetry from the Cognee host to a data lake or Security Information and Event Management (SIEM) platform for baselining.
Alert on any modification to LLM or vector database provider fields outside a change-management window.

How to Mitigate CVE-2026-58473

Immediate Actions Required

Upgrade Cognee to version 1.2.0 or later, which enforces the superuser check on the settings endpoint.
Set COGNEE_PUBLIC_REGISTRATION_ENABLED=false to disable open account registration on production deployments.
Rotate any LLM provider API keys that were reachable from an affected instance before the upgrade.
Review existing user accounts and remove any unrecognized registrations created while the instance was exposed.

Patch Information

The fix is available in Cognee release v1.2.0 and commit d10b1b77. See the VulnCheck Security Advisory and the GitHub issue discussion for background.

Workarounds

Place the Cognee API behind a reverse proxy that denies external access to /api/v1/settings and /auth/register.
Restrict Cognee network exposure to trusted internal networks or a VPN until the upgrade is applied.
Enforce egress filtering so the Cognee host can only reach approved LLM provider domains.

bash

# Configuration example: disable public registration and pin to trusted egress
export COGNEE_PUBLIC_REGISTRATION_ENABLED=false

# Example nginx block to restrict administrative endpoints
location /api/v1/settings {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://cognee_upstream;
}

location /auth/register {
    deny all;
}