{"data":{"id":"a53143c0-7670-4add-9660-224b828b86c8","title":"CVE-2026-24477: AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during…","summary":"AnythingLLM versions before 1.10.0, when configured to use Qdrant as the vector database with an API key, expose the QdrantApiKey in plain text to unauthenticated users through the /api/setup-complete endpoint. An unauthenticated attacker who obtains the key gains full read/write access to the Qdrant instance, which can compromise retrieval functionality and leak confidential uploaded documents.","solution":"Fixed in 1.10.0.","labels":["security","privacy"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-24477","publishedAt":"2026-01-27T05:15:51.150Z","cveId":"CVE-2026-24477","cweIds":["CWE-201"],"cvssScore":"7.5","cvssSeverity":"high","severity":"high","attackType":["data_extraction","pii_leakage"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["AnythingLLM","Qdrant"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"AnythingLLM exposes Qdrant API key via /api/setup-complete endpoint","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.02107,"epssCheckedAt":"2026-11-04T12:08:35.001Z","kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-04T00:12:37.529Z","patchAvailable":null,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity"],"aiComponentTargeted":"rag","llmSpecific":false,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null,"fixes":[]}}