Answer in brief
CVE-2026-58473 records a Critical severity (CVSS 9.3) vulnerability in Cognee < 1.2.0 Unauthorized LLM Configuration Overwrite via /api/v1/settings. The current sources do not mark it as known exploited. The current feed maps topoteretes/cognee (generic), cognee (pip), cognee (pypi). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 9.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps topoteretes/cognee (generic), cognee (pip), cognee (pypi). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| topoteretes/cogneegeneric | * | Not reported |
| cogneepip | <1.5.0 | 1.5.0 |
| cogneepypi | >=0 <1.5.0 | 1.5.0 |
Published upstream
Jul 7, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 8, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jul 7, 2026
Cognee before 1.2.0 contains an improper access control vulnerability that allows unauthenticated attackers to overwrite the global LLM provider configuration by self-registering an account and calling the settings endpoint, which performs no admin or superuser check. Attackers can redirect all LLM operations instance-wide to an attacker-controlled endpoint by exploiting the process-wide singleton configuration cache, enabling exfiltration of prompts, uploaded documents, extracted entities, and knowledge graph content from all users.
Quoted source text, attributed separately from HOL analysis.