CVE-2026-90601: Getzep Graphiti Auth Bypass Vulnerability

CVE-2026-90601 Overview

CVE-2026-90601 is an improper authentication vulnerability [CWE-287] in getzep graphiti versions up to 0.30.2. The flaw resides in an unspecified function within server/graph_service/main.py, part of the REST API component. Attackers can exploit the weakness remotely over the network without prior authentication or user interaction. The graphiti project is an open-source framework for building knowledge graphs used in AI agent memory workloads, which makes exposed instances a potential target for data exposure or manipulation. A pull request addressing the issue has been submitted upstream and awaits acceptance at the time of publication.

Critical Impact
Unauthenticated remote attackers can bypass authentication checks on the graphiti REST API, exposing knowledge graph data managed by the service.

Affected Products

getzep graphiti versions up to and including 0.30.2
Component: REST API implemented in server/graph_service/main.py
Deployments exposing the graphiti graph service over the network

Discovery Timeline

2026-09-13 - CVE-2026-90601 published to the National Vulnerability Database (NVD)
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-90601

Vulnerability Analysis

The vulnerability is classified as Improper Authentication [CWE-287] within the graphiti graph service REST API. An unknown function in server/graph_service/main.py fails to enforce proper authentication before processing requests. As a result, remote clients can interact with API endpoints without valid credentials. The manipulation impacts confidentiality, integrity, and availability at a limited level, according to the assigned CVSS 4.0 vector. Because graphiti is commonly deployed as a backing service for AI agent memory and retrieval workflows, unauthenticated access can expose graph nodes, edges, and stored context that downstream applications rely upon.

Root Cause

The root cause is the absence or incorrect implementation of authentication enforcement in a REST API handler defined in server/graph_service/main.py. Endpoints that should require an authenticated principal accept requests without validating the caller's identity. Public references, including GitHub Issue #1716 and GitHub Pull Request #1739, describe the missing authentication path and the proposed fix.

Attack Vector

Exploitation requires only network reachability to the graphiti REST API. An attacker sends crafted HTTP requests to affected endpoints without supplying credentials. Because the vulnerable code path does not authenticate the request, the server processes the operation as if it were legitimate. No user interaction, elevated privileges, or specialized conditions are required. Instances exposed to the internet or reachable from untrusted internal networks are at highest risk.

No verified proof-of-concept code is available. Refer to the graphiti project repository and VulDB entry for CVE-2026-90601 for further technical context.

Detection Methods for CVE-2026-90601

Indicators of Compromise

Unauthenticated HTTP requests reaching graphiti REST API endpoints hosted by graph_service
Unexpected read or write operations against graph nodes, edges, or episodes without an associated authenticated session
Requests originating from unfamiliar IP ranges targeting the graphiti service port
Anomalous spikes in API traffic to /messages, /entity-edge, /search, or similar graphiti routes

Detection Strategies

Enable access logging on the graphiti REST API and alert when requests are processed without an authentication header or token
Deploy a reverse proxy or API gateway in front of graphiti that enforces authentication and logs all unauthenticated attempts
Inspect application logs for successful API operations lacking a corresponding authenticated principal identifier
Correlate outbound data volume from the graphiti service against expected baselines to detect bulk enumeration

Monitoring Recommendations

Monitor network flows to any host running graphiti <= 0.30.2 and alert on ingress from non-allowlisted sources
Track the version of graphiti deployed across environments and flag instances that remain on affected releases
Forward graphiti application and proxy logs to a centralized logging platform for retention and search
Review the GitHub Pull Request #1739 diff to build code-level detections aligned with the vulnerable handler

How to Mitigate CVE-2026-90601

Immediate Actions Required

Restrict network exposure of the graphiti REST API to trusted management networks only
Place graphiti behind an authenticating reverse proxy, API gateway, or service mesh that enforces mutual TLS or bearer token validation
Audit graphiti deployments to inventory all instances running versions up to 0.30.2
Rotate any credentials, tokens, or secrets stored within the graph service that may have been accessed by unauthenticated callers

Patch Information

At the time of publication, an official patched release addressing CVE-2026-90601 is pending. The fix is proposed in GitHub Pull Request #1739 against the getzep/graphiti repository. Track GitHub Issue #1716 and the project's release notes for the merged fix and upgrade guidance.

Workarounds

Terminate the graphiti REST API on an internal interface only and block external access at the firewall
Front the service with a proxy such as NGINX, Envoy, or a cloud API gateway that requires authenticated requests before forwarding traffic
Apply network policies in Kubernetes environments to limit which pods and namespaces can reach the graphiti service
Disable or scale down the graph_service deployment in environments where it is not actively required until a patched release is available

bash

# Example NGINX reverse proxy snippet enforcing bearer token auth in front of graphiti
server {
    listen 443 ssl;
    server_name graphiti.internal.example.com;

    location / {
        if ($http_authorization !~* "^Bearer [A-Za-z0-9._-]+$") {
            return 401;
        }
        proxy_pass http://127.0.0.1:8000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }
}