CVE-2026-24477

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. If AnythingLLM prior to version 1.10.0 is configured to use Qdrant as the vector database with an API key, this QdrantApiKey could be exposed in plain text to unauthenticated users via the `/api/setup-complete` endpoint. Leakage of QdrantApiKey allows an unauthenticated attacker full read/write access to the Qdrant vector database instance used by AnythingLLM. Since Qdrant often stores the core knowledge base for RAG in AnythingLLM, this can lead to complete compromise of the semantic search / retrieval functionality and indirect leakage of confidential uploaded documents. Version 1.10.0 patches the issue.

• CWE-201

• https://github.com/Mintplex-Labs/anything-llm/security/advisories/GHSA-gm94-qc2p-xcwfExploit, Vendor Advisory

Published

Jan 27, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-24470Skipper is an HTTP router and reverse proxy for service comp…8.1
• CVE-2026-24471continuwuity is a Matrix homeserver written in Rust. This vu…9.3
• CVE-2026-24472Hono is a Web application framework that provides support fo…5.3
• CVE-2026-24473Hono is a Web application framework that provides support fo…5.3
• CVE-2026-24474Dioxus Components is a shadcn-style component library for th…5.3
• CVE-2026-24476Shaarli is a personal bookmarking service. Prior to version …5.4
• CVE-2026-24478AnythingLLM is an application that turns pieces of content i…7.2
• CVE-2026-24479HUSTOF is an open source online judge based on PHP/C++/MySQL…9.8
• CVE-2026-2448The Page Builder by SiteOrigin plugin for WordPress is vulne…8.8
• CVE-2026-24480QGIS is a free, open source, cross platform geographical inf…8.7
• CVE-2026-24481ImageMagick is free and open-source software used for editin…7.5
• CVE-2026-24484ImageMagick is free and open-source software used for editin…5.3