CVE-2026-24477General(mintplexlabs / anythingllm)

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch mintplexlabs anythingllm systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. If AnythingLLM prior to version 1.10.0 is configured to use Qdrant as the vector database with an API key, this QdrantApiKey could be exposed in plain text to unauthenticated users via the `/api/setup-complete` endpoint. Leakage of QdrantApiKey allows an unauthenticated attacker full read/write access to the Qdrant vector database instance used by AnythingLLM. Since Qdrant often stores the core knowledge base for RAG in AnythingLLM, this can lead to complete compromise of the semantic search / retrieval functionality and indirect leakage of confidential uploaded documents. Version 1.10.0 patches the issue.

mintplexlabs CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Exploit / PoC references

https://github.com/Mintplex-Labs/anything-llm/security/advisories/GHSA-gm94-qc2p-xcwf

Weakness type (CWE)

CWE-201

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

anythingllm

Threat summary

Patch or workaround signal is available
2 mentions across 2 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 1 signal
General: 1 classified signal
Peaked 1d ago at 1 mentions (2026-03-17); latest day: 1
2 total mentions across 2 days

Affected systems

Vendors

mintplexlabs

Products

anythingllm

Deep dive

Activity timeline2 mentions / 2d

Signal classification2 categories

General

150.0%

Patch

150.0%

Referenced assets1 URL

By indicator

https://cloud.projectdiscovery.io/library/CVE-2026-24477

Classification over time

Date	Total	Labels

2026-03-17	1	General1
2026-08-15	1	Patch1

Full discourse2 posts

pdnuclei-bot@pdnuclei_bot205d
General
🚨 CVE-2026-24477 - high 🚨 AnythingLLM - Information Disclosure > AnythingLLM is an application that turns pieces of content into context that any LLM ... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-24477 @pdnuclei #NucleiTemplates #cve
Post summary
The tweet simply announces CVE‑2026‑24477 with a slight severity label and links to a Project Discovery resource, but provides no actionable technical info or evidence of exploitation.
00013217
901 followersView on X
bluehatone@bluehatone54d
Patch
AI agents can leak data. Asana’s server mixed customer data. About 1,000 were notified and it was offline nearly two weeks. Shared vector databases can leak across tenants. AnythingLLM exposed a Qdrant key, CVE-2026-24477. Fix it: audit agents, least privilege, logs, kill switch.
Post summary
An AI agent exposed a Qdrant key (CVE-2026-24477), with recommendations to audit agents, enforce least privilege, monitor logs, and deploy kill switches.
0000047
27 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	mintplexlabs	anythingllm	-	-	-

Explore more

Back to dashboard mintplexlabs CVEs anythingllm vulnerabilities