CVE-2026-32617: AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.11.1 and earlier, On default installations where no password or API ...

Added to the CISA Known Exploited Vulnerabilities catalog on 16 Mar 2026. Vendor: AI/ML. Product: LLM. CVSS score: 7.1.

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.11.1 and earlier, On default installations where no password or API key has been configured, all HTTP endpoints and the agent WebSocket lack authentication, and the ser...

Required action: Review and patch if applicable to your AI infrastructure.