CVE-2026-24477: 
Homebrew vulnerability analysis and mitigation

CVE-2026-24477 is an information disclosure vulnerability in AnythingLLM (by Mintplex Labs) that exposes the Qdrant vector database API key in plaintext to unauthenticated users via the /api/setup-complete endpoint. The vulnerability affects all AnythingLLM versions prior to 1.10.0 when configured to use Qdrant as the vector database with an API key. It was published on January 27, 2026, and patched in version 1.10.0. The advisory also notes the same impact applies to Weaviate connections. The CVSS v3.1 base score is 7.5 (High) and the CVSS v4.0 base score is 8.7 (High) (GitHub Advisory, Red Hat CVE).

The root cause is classified as CWE-201 (Insertion of Sensitive Information Into Sent Data). The /api/setup-complete endpoint in AnythingLLM does not require authentication, even when the main application is protected with credentials. While most sensitive configuration values returned by this endpoint are masked or redacted, the QdrantApiKey field is returned as-is due to missing conditional logic in the serialization function (systemSettings.js), where the key should have been replaced with a boolean/existence check rather than its plaintext value. Exploitation requires only a simple unauthenticated HTTP GET request to the endpoint — no special tools or privileges are needed (GitHub Advisory).

Successful exploitation allows an unauthenticated attacker to retrieve the plaintext Qdrant API key, granting full read/write access to the Qdrant vector database instance used by AnythingLLM. An attacker can read all embedded vectors and metadata to extract sensitive document chunks or full content from uploaded files and workspaces, delete or overwrite collections causing data loss, enumerate all documents and workspaces to gain insight into private user data, and in multi-tenant setups, achieve cross-workspace data exposure or denial of service. Since Qdrant stores the core knowledge base for RAG (Retrieval-Augmented Generation) in AnythingLLM, this leads to complete compromise of semantic search/retrieval functionality and indirect leakage of confidential uploaded documents (GitHub Advisory).

A proof-of-concept exploit is publicly available via the GitHub security advisory, demonstrating exploitation with a simple curl command. There is no evidence of active in-the-wild exploitation at this time. The EPSS score is 0.023% (very low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Notably, a Nuclei detection template was added to the ProjectDiscovery nuclei-templates repository, enabling automated scanning for vulnerable instances (GitHub Advisory, Feedly).

1. Reconnaissance: Identify internet-facing AnythingLLM instances (prior to version 1.10.0) using tools like Shodan, Censys, or the ProjectDiscovery Nuclei template for CVE-2026-24477.
2. Probe the unauthenticated endpoint: Send an unauthenticated HTTP GET request to the /api/setup-complete endpoint of the target AnythingLLM instance (e.g., curl http://<target>:3001/api/setup-complete).
3. Extract the API key: Parse the JSON response and locate the QdrantApiKey field, which is returned in plaintext (e.g., "QdrantApiKey":"HWTt0aqGVdzs**********").
4. Access the Qdrant database: Use the extracted API key to authenticate directly against the Qdrant vector database instance, gaining full read/write access (e.g., using the Qdrant REST API or client libraries).
5. Exfiltrate or manipulate data: Read all stored vectors and metadata to extract document content, enumerate collections/workspaces, overwrite or delete collections, or leverage access for further lateral movement within the environment (GitHub Advisory).

• Network: Unauthenticated HTTP GET requests to /api/setup-complete from external or unexpected IP addresses in web server access logs; unusual outbound connections from the AnythingLLM server to the Qdrant database port (default: 6333/6334) from unfamiliar source IPs.
• Logs: AnythingLLM access logs showing repeated or automated requests to /api/setup-complete without prior authentication; Qdrant database logs showing API key usage from IP addresses not associated with the AnythingLLM application server.
• Application: Unexpected reads, deletions, or modifications of Qdrant collections not initiated by the AnythingLLM application; enumeration of all collections or points in the Qdrant instance.

Upgrade AnythingLLM to version 1.10.0 or later, which patches the missing conditional logic in systemSettings.js to properly mask the QdrantApiKey in the /api/setup-complete response. If immediate patching is not possible, restrict network-level access to the /api/setup-complete endpoint using a firewall, reverse proxy (e.g., nginx deny rules), or application-level middleware to prevent unauthenticated external access. Additionally, consider rotating the Qdrant API key if the instance was potentially exposed, and audit Qdrant access logs for unauthorized activity (GitHub Advisory).

The vulnerability was reported by researcher LagonGit and published by AnythingLLM maintainer timothycarambat on January 24, 2026. The issue received coverage in security community feeds including Secret CISO and InfinitSec, and was noted on Bluesky by security community accounts. ProjectDiscovery added a Nuclei detection template for automated scanning of this vulnerability, indicating community interest in detection tooling (GitHub Advisory, Feedly).