| Component | AnythingLLM |
| Severity | high (CVSS 7.1) |
| CVSS vector | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L |
| Published (NVD) | 2026-03-16 |
| Last modified | 2026-06-17 |
| Affected versions | anythingllm <= 1.11.1 |
| Fixed in | see the vendor advisory |
| Weakness | CWE-942CWE-1188 |
| CISA KEV | not listed |
NVD description
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.11.1 and earlier, On default installations where no password or API key has been configured, all HTTP endpoints and the agent WebSocket lack authentication, and the server's CORS policy accepts any origin. AnythingLLM Desktop binds to 127.0.0.1 (loopback) by default. Modern browsers (Chrome, Edge, Firefox) implement Private Network Access (PNA). This explicitly blocks public websites from making requests to local IP addresses. Exploitation is only viable from within the same local network (LAN) due to browser-level blocking of public-to-private requests.
What to do
- NVD lists no fixed version yet: follow the vendor advisory below and keep AnythingLLM off the public internet until a fix ships.
- Do not expose the component's API or UI to the internet without authentication in front of it.
Sources
- NVD: CVE-2026-32617
- https://github.com/Mintplex-Labs/anything-llm/security/advisories/GHSA-24qj-pw4h-3jmm
Other AnythingLLM CVEs
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.16.1 and ea...
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. From 1.0.0 to 1....
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. From 1.11.1 unti...
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to 1.13.0,...
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to 1.13.0,...
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to 1.13.0,...