CVE-2026-32617: 
Homebrew vulnerability analysis and mitigation

CVE-2026-32617 is an authentication bypass and permissive CORS policy vulnerability in AnythingLLM (by Mintplex Labs) affecting versions 1.11.1 and earlier. On default installations where no password or API key has been configured, all HTTP endpoints and the agent WebSocket lack authentication, and the server's CORS policy accepts any origin, enabling unauthenticated access from any cross-origin request. The vulnerability was published on March 13–16, 2026, with a security advisory issued by the AnythingLLM team. The CVSS v3.1 base score is 7.5 (High) per NVD, while the vendor's revised scoring places it at 7.1 (High/Medium) after downgrading from an initially reported Critical 10.0 (GitHub Advisory).

The vulnerability has two root causes classified under CWE-942 (Permissive Cross-domain Policy with Untrusted Domains) and CWE-1188 (Insecure Default Initialization of Resource). First, the validatedRequest middleware in server/utils/middleware/validatedRequest.js contains a blanket bypass: if NODE_ENV equals development or if AUTH_TOKEN/JWT_SECRET are not set, all protected endpoints are accessible without credentials — the default state on fresh installations. Second, both the main server and collector apply cors({ origin: true }), reflecting any origin, and SSE streaming endpoints set Access-Control-Allow-Origin: *. The agent WebSocket endpoint /api/agent-invocation/:uuid has no authentication middleware at all. Exploitation from a remote public origin is partially mitigated by browser-level Private Network Access (PNA) controls in Chromium-based browsers, but Firefox (as of version 148) does not enforce PNA, leaving those users exposed to CORS-based drive-by attacks from within the same LAN (GitHub Advisory).

A successful exploit allows an unauthenticated attacker on the same local network to read all workspaces, documents, chat history, system settings, environment variables, and API keys (confidentiality); modify settings, create or delete users, alter LLM configurations, and manipulate data (integrity); and delete workspaces or disrupt service operation (availability). Through the agent's tools, the attacker can also reach systems beyond the application itself, enabling server-side request forgery (SSRF), SQL injection against connected databases, and potentially remote code execution (RCE) under certain configurations, making lateral movement into internal network services a realistic risk (GitHub Advisory).

A proof-of-concept (PoC) exploit is publicly available in the GitHub security advisory, including curl commands targeting /api/workspaces and /api/admin/users, and a Python PoC server (poc_malicious_server.py) demonstrating a CORS-based drive-by browser attack with two phases: data exfiltration and agent hijacking. There is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.045% (0.000450), indicating low but non-zero probability of exploitation in the near term. The vulnerability is not currently listed in the CISA KEV catalog. Exploitation is constrained to the local network (LAN) for most users due to browser PNA enforcement in Chromium-based browsers, though Firefox users remain more exposed (GitHub Advisory).

1. Reconnaissance: Identify AnythingLLM instances on the local network (default port 3001) using network scanning tools such as nmap. Confirm the version is 1.11.1 or earlier and that no authentication has been configured.
2. Verify authentication bypass: Send unauthenticated HTTP requests to confirm the bypass is active:

   curl http://<target-ip>:3001/api/workspaces
   curl http://<target-ip>:3001/api/admin/users
   curl http://<target-ip>:3001/api/system/env-dump

3. Verify permissive CORS: Confirm the server reflects any origin:

   curl -H "Origin: https://evil.example.com" -v http://<target-ip>:3001/api/workspaces 2>&1 | grep Access-Control

   A response of Access-Control-Allow-Origin: https://evil.example.com confirms exploitability.
4. Phase 1 – Data exfiltration (browser-based): Host a malicious webpage (e.g., using poc_malicious_server.py) that, when visited by a victim on the same LAN using Firefox, silently performs cross-origin fetch() requests to exfiltrate system settings, API keys, workspace configurations, chat history, and MCP server lists.
5. Phase 2 – Agent hijacking: The malicious page sends an @agent prompt to the first available workspace via the unauthenticated stream-chat endpoint, parses the SSE response for the websocketUUID, and opens a cross-origin WebSocket to /api/agent-invocation/{uuid} to stream the agent's full response, including tool invocations that may trigger SSRF, SQLi, or RCE.
6. Escalation: Use retrieved credentials, API keys, or agent tool access to pivot to internal network services or execute commands on the host (GitHub Advisory).

• Network: Unexpected HTTP requests to port 3001 from non-localhost origins; cross-origin requests with arbitrary Origin headers receiving Access-Control-Allow-Origin responses matching the attacker's domain; WebSocket connections to /api/agent-invocation/<uuid> from unexpected sources.
• Logs: Access logs showing unauthenticated requests to /api/workspaces, /api/admin/users, /api/system/env-dump, or /api/agent-invocation/ endpoints without valid auth tokens; repeated requests to stream-chat endpoints followed immediately by WebSocket connections.
• Application Behavior: Unexpected workspace deletions, new user accounts created without administrator action, modified LLM configurations, or unusual agent invocations appearing in chat history.
• File System: Presence of poc_malicious_server.py or similar Python PoC scripts on attacker-controlled systems; /etc/hosts modifications mapping attacker domains to 127.0.0.1 on victim machines (indicating PoC setup) (GitHub Advisory).

The AnythingLLM team has implemented Strict CORS Origin Validation and Custom Header Enforcement in releases after version 1.11.1; users should update immediately. For deployments that cannot be immediately updated, configure a strong password or API key during initial setup to enable authentication middleware, which eliminates the blanket bypass. Additionally, restrict network access to the AnythingLLM instance to trusted hosts only (e.g., via firewall rules), ensure the application is not exposed beyond the local network unless necessary, and avoid running the server with NODE_ENV=development in production environments (GitHub Advisory).

The vulnerability was initially reported with a Critical 10.0 CVSS score, which the AnythingLLM team disputed and downgraded to 7.1 (High/Medium) after their own technical review found the zero-click drive-by attack vector to be non-reproducible in standard Chromium-based browser environments due to Private Network Access enforcement. The advisory notes that Firefox 148 does not yet enforce PNA, keeping that attack vector viable for Firefox users. RedPacketSecurity and CyberHub highlighted the CVE on social media shortly after publication. The status is marked as "Disputed" in the advisory, reflecting the disagreement between the original reporter's Critical rating and the vendor's revised assessment (GitHub Advisory).