Answer in brief
CVE-2026-105141 records a Medium severity (CVSS 5.3) vulnerability in topoteretes cognee JWT Signing Key get_api_auth_backend.py get_user_id_by_email hard-coded credentials. The current sources do not mark it as known exploited. The current feed maps topoteretes/cognee (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps topoteretes/cognee (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| topoteretes/cogneegeneric | 1.5.0 || 1.5.1 || 1.5.2 || 1.5.3 || 1.5.4 | Not reported |
Published upstream
Oct 4, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 4, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 4, 2026
A security flaw has been discovered in topoteretes cognee up to 1.5.4. The affected element is the function get_user_id_by_email of the file cognee/modules/users/authentication/get_api_auth_backend.py of the component JWT Signing Key Handler. The manipulation of the argument FASTAPI_USERS_JWT_SECRET results in hard-coded credentials. The attack may be launched remotely. Upgrading to version 1.6.0 is sufficient to fix this issue. The patch is identified as fa65fc0cd86cdba48d19aa76e36be862be982f5d. Upgrading the affected component is advised.
Quoted source text, attributed separately from HOL analysis.