{
 "id": "AIR-2026-0952",
 "slug": "cve-2026-24477-anythingllm-api-key-exposure-vulnerability",
 "title": "CVE-2026-24477: AnythingLLM API Key Exposure Vulnerability",
 "summary": "AnythingLLM before version 1.10.0 exposes the Qdrant API key in plain text via an unauthenticated endpoint. This vulnerability allows attackers to gain full read and write access to the underlying vector database.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln",
  "data_leak"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "AnythingLLM",
  "Qdrant"
 ],
 "incident_date": "2026-01-27",
 "incident_date_precision": "day",
 "first_reported": "2026-01-27",
 "sources": [
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24477",
   "publisher": "NVD",
   "title": "CVE-2026-24477: AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting.",
   "published_at": "2026-01-27"
  }
 ],
 "source_count": 1,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_nvd",
 "tags": [
  "CVE-2026-24477",
  "anythingllm",
  "qdrant",
  "api-key-leak"
 ],
 "created_at": "2026-10-18T10:04:21.885Z",
 "updated_at": "2026-10-18T10:04:21.885Z"
}