MediumVulnerabilityLLM-specific
CVE-2026-7844: Langchain-Chatchat missing authentication in Compatible File Service
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-7844
- Published
- Record updated
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.3%
Summary
A flaw in chatchat-space Langchain-Chatchat up to 0.3.1.3 affects the files, list_files, retrieve_file, retrieve_file_content and delete_file functions in libs/chatchat-server/chatchat/server/api_server/openai_routes.py, within the Compatible File Service component. The functions lack authentication, so an attacker on the local network can execute the attack. A public exploit exists, and the project was informed through an issue report but has not yet responded.
Mitigation
The source does not state a fix yet. Check the original advisory for updates.
Related items
- HighCVE-2026-97677: IBM Langflow OSS arbitrary file write and read by authenticated flow authorsSimilar attack · NVD/CVE Database
- MediumRecent AI agent experiments reveal a risky future of machine 'teamwork' inside corporationsSimilar attack · CNBC Technology
- MediumClaude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHubSimilar attack · The Hacker News
- MediumCVE-2026-118046: JS Help Desk plugin stored DOM-based cross-site scripting via jsticket_messageSimilar attack · NVD/CVE Database
- MediumARTEX abuse expands as cybercriminals target financial sectorSimilar attack · Microsoft Security Blog