CVE-2026-85671: QAnything 2.0.0 Authentication Bypass Vulnerability

CVE-2026-85671 Overview

CVE-2026-85671 is an authentication bypass vulnerability in QAnything 2.0.0, a knowledge base question-answering system maintained by NetEase Youdao. The flaw resides in the /api/local_doc_qa/get_file_base64 and /api/local_doc_qa/get_doc endpoints, which expose uploaded files and parsed document chunks without verifying caller identity or ownership. Unauthenticated attackers can enumerate file identifiers through adjacent unauthenticated endpoints, then retrieve base64-encoded files and document content belonging to any tenant. The vulnerability is classified as Missing Authentication for Critical Function [CWE-306] and results in cross-tenant knowledge base disclosure.

Critical Impact
Unauthenticated remote attackers can retrieve arbitrary uploaded files and parsed documents from any user of a QAnything 2.0.0 instance, breaking tenant isolation and exposing sensitive knowledge base content.

Affected Products

NetEase Youdao QAnything 2.0.0
Deployments using the qanything_server handler shipped in v2.0.0
Any hosted or self-hosted QAnything instance exposing the /api/local_doc_qa/ endpoints

Discovery Timeline

2026-09-04 - CVE-2026-85671 published to NVD
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-85671

Vulnerability Analysis

QAnything exposes an HTTP API for uploading documents, parsing them into retrieval-augmented generation (RAG) chunks, and serving the raw and parsed content back to authorized users. Two endpoints in the v2.0.0 handler, /api/local_doc_qa/get_file_base64 and /api/local_doc_qa/get_doc, accept a file identifier and return the corresponding content. Neither endpoint validates the requester's session, API token, or ownership of the requested object. An attacker who reaches the API over the network can therefore read any uploaded file or parsed document by supplying a valid identifier.

Because other unauthenticated endpoints in the same handler expose enumerable file identifiers, an attacker can chain the two behaviors: enumerate identifiers, then retrieve content. The result is full cross-tenant disclosure of knowledge base material, including base64-encoded original files and parsed text chunks used for embedding and retrieval.

Root Cause

The root cause is Missing Authentication for Critical Function [CWE-306]. The endpoint handlers implemented in qanything_kernel/qanything_server/handler.py do not enforce authentication or ownership checks before returning file bytes or parsed chunks. Access control was expected but never implemented on these routes, so any network-reachable client is treated as authorized.

Attack Vector

Exploitation requires only network access to the QAnything API. An attacker issues HTTP requests to /api/local_doc_qa/get_file_base64 or /api/local_doc_qa/get_doc with harvested file identifiers and receives the corresponding content without providing credentials. No user interaction is required, and confidentiality of stored documents is fully compromised while integrity and availability remain unaffected. Refer to the VulnCheck Advisory for QAnything and GitHub Issue #670 for endpoint behavior details.

Detection Methods for CVE-2026-85671

Indicators of Compromise

Unauthenticated HTTP requests to /api/local_doc_qa/get_file_base64 or /api/local_doc_qa/get_doc from external or unexpected source addresses.
Sequential or scripted access patterns iterating through file or document identifiers within short time windows.
Anomalously large outbound response volumes from the QAnything service tied to get_file_base64 responses containing base64 payloads.

Detection Strategies

Inspect QAnything and reverse-proxy access logs for requests to the affected endpoints that lack an authenticated session cookie or bearer token.
Correlate identifier-enumeration endpoints with subsequent get_file_base64 or get_doc calls sharing the same source IP within a short window.
Alert on cross-tenant access where the identifier retrieved does not map to any file owned by the requester's account context.

Monitoring Recommendations

Forward QAnything application and web server logs to a centralized SIEM or data lake for retention and correlation.
Baseline normal request rates to /api/local_doc_qa/ endpoints and generate alerts on volumetric or velocity deviations.
Monitor egress bandwidth from hosts running QAnything for spikes consistent with bulk document exfiltration.

How to Mitigate CVE-2026-85671

Immediate Actions Required

Restrict network exposure of QAnything 2.0.0 instances so that the API is not reachable from untrusted networks or the public internet.
Place the service behind an authenticating reverse proxy that terminates requests to /api/local_doc_qa/get_file_base64 and /api/local_doc_qa/get_doc for unauthenticated callers.
Audit stored knowledge base content and treat any sensitive documents uploaded to an exposed instance as potentially disclosed.

Patch Information

As of the NVD publication date of 2026-09-04, no vendor-issued patch is referenced in the CVE record. Track the upstream project at the GitHub QAnything Repository and GitHub Issue #670 for a fixed release. Review the vulnerable handler code in the GitHub QAnything Handler Script when applying private mitigations.

Workarounds

Enforce authentication and ownership checks at an upstream proxy or API gateway before requests reach the QAnything handler.
Block or filter access to /api/local_doc_qa/get_file_base64 and /api/local_doc_qa/get_doc for any request lacking a validated session token.
Segment QAnything deployments per tenant and require mutual TLS or network-level allow lists for API consumers until a patched version is available.

bash

# Example NGINX snippet to require an auth token header before proxying
# the affected QAnything endpoints. Adjust auth_request target as needed.
location ~ ^/api/local_doc_qa/(get_file_base64|get_doc)$ {
    auth_request /_validate_token;
    proxy_pass http://qanything_upstream;
}

location = /_validate_token {
    internal;
    proxy_pass http://auth_service/validate;
    proxy_pass_request_body off;
    proxy_set_header Content-Length "";
    proxy_set_header X-Original-URI $request_uri;
}