{"action":"Upgrade cognee to 1.5.0 or later.","affected":[{"fixed":"1.5.0","introduced":"0"}],"component":"cognee","cve_ids":["CVE-2026-58473"],"ecosystem":"PyPI","epss":0.00511,"exploited":false,"fixed_versions":["1.5.0"],"ghsa_id":"GHSA-49f7-whx5-4256","id":"tcs_01M5KH7YFTH4Q3Z2T1FVVYG2FJ","modified_at":"2026-09-10T12:15:03.031246070Z","published_at":"2026-09-10T09:44:50.382766Z","references":["https://osv.dev/vulnerability/PYSEC-2026-3816","https://nvd.nist.gov/vuln/detail/CVE-2026-58473","https://github.com/topoteretes/cognee/issues/3084","https://github.com/topoteretes/cognee/commit/10971db1b0bd97e88f96bd2a9ffb3edb7b22bcd0","https://github.com/topoteretes/cognee/commit/d10b1b77e2157c6238fd4d1acb1923a048991699","https://github.com/topoteretes/cognee/commit/ebcf82412d0954f5c5018444f7eee8d96fee5113","https://github.com/topoteretes/cognee","https://github.com/topoteretes/cognee/releases/tag/v1.2.0","https://www.vulncheck.com/advisories/cognee-unauthorized-llm-configuration-overwrite-via-api-v1-settings","https://pypi.org/project/cognee","https://github.com/advisories/GHSA-49f7-whx5-4256"],"severity":{"label":"critical","score":9.1},"sources":[{"source":"osv","source_id":"PYSEC-2026-3816","url":"https://osv.dev/vulnerability/PYSEC-2026-3816"}],"summary":"Cognee allows non-superusers to overwrite global LLM configuration"}