CVE-2026-90601
A vulnerability was found in getzep graphiti up to 0.30.2. Affected is an unknown function of the file server/graph_service/main.py of the component REST API. The manipulation results in improper authentication. The attack can be launched remotely. The pull request to fix this issue awaits acceptance.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 7.5
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
- EPSS probability
- 0.41%
- CWE
- CWE-287
- Published
- 2026-09-13
- Last modified
- 2026-09-15
Affected products
- getzep graphiti
- getzep graphiti
- getzep graphiti
Weakness type
Related vulnerabilities
- CVE-2026-82329 — Potential authentication bypass leading to administrative access in Artifactory
- CVE-2026-85595 — Traefik before v2.11.55 and v3.0.0 through v3.7.10 Authentication Bypass via digestAuth
- CVE-2026-42018 — Anonymous user token generation exposure in JFrog Artifactory
- CVE-2026-68569 — Apache Tomcat: Principal lookup can fail open in some cases
- CVE-2026-19977 — EFM ipTIME A3004T Session Validation httpcon_check_session_url improper authentication
- CVE-2026-59500 — Priority - CWE-287: Improper Authentication
- CVE-2026-82695 — Tenda AC18 Telnet telnet missing authentication
- CVE-2026-82694 — Tenda AC1206 Web UI ate R7WebsSecurityHandler missing authentication