{
 "id": "AIR-2026-0988",
 "slug": "cve-2026-32617-authentication-bypass-and-loose-cors-in-anyth",
 "title": "CVE-2026-32617: Authentication bypass and loose CORS in AnythingLLM",
 "summary": "Default installations of AnythingLLM lacking passwords leave endpoints and WebSockets unauthenticated with permissive CORS policies. Although desktop versions bind to localhost, browser networking layers can be leveraged under specific conditions.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling",
  "enterprise_deployment"
 ],
 "products": [
  "AnythingLLM"
 ],
 "incident_date": "2026-03-16",
 "incident_date_precision": "day",
 "first_reported": "2026-03-16",
 "sources": [
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32617",
   "publisher": "NVD",
   "title": "CVE-2026-32617: AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting.",
   "published_at": "2026-03-16"
  }
 ],
 "source_count": 1,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_nvd",
 "tags": [
  "CVE-2026-32617",
  "auth-bypass",
  "cors"
 ],
 "created_at": "2026-10-18T10:04:21.885Z",
 "updated_at": "2026-10-18T10:04:21.885Z"
}