Executive Summary

CVE-2026-32617 affects the AnythingLLM application version 1.11.1 and earlier, where default installations lack proper authentication on all HTTP endpoints and the agent WebSocket. The server uses a permissive CORS policy that accepts requests from any origin, allowing unauthenticated remote access to the local API.

The vulnerability arises because authentication middleware can be bypassed if certain environment variables are unset or if the environment is set to development mode. Additionally, the WebSocket endpoint relies only on UUID existence for access, which can be obtained without protection.

The server binds to all network interfaces by default, exposing it to remote attackers if not properly firewalled. Modern browsers implement protections that limit exploitation to local network attacks, but some browsers like Firefox do not enforce these protections fully.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts on confidentiality, integrity, and availability of the AnythingLLM instance.

• Confidentiality: Attackers can read all workspaces, chat history, system settings, environment variables, and internal network responses.
• Integrity: Attackers can modify settings, create or delete users, alter LLM configurations, and execute arbitrary code.
• Availability: Attackers can delete workspaces, reset the system, and disrupt service.

Exploitation can occur remotely if the server is exposed to the internet or locally via malicious websites on the same network, potentially leading to server-side request forgery, SQL injection, and remote code execution.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability can be detected by checking if the AnythingLLM server is running version 1.11.1 or earlier and if it is bound to 0.0.0.0 on port 3001 (HTTP) or port 8888 (collector), exposing unauthenticated HTTP and WebSocket endpoints.'}, {'type': 'paragraph', 'content': 'You can scan your network or system for open ports and services using commands like:'}, {'type': 'list_item', 'content': 'nmap -p 3001,8888 <target-ip> # Scan for AnythingLLM default ports'}, {'type': 'list_item', 'content': 'curl -v http://<target-ip>:3001/ # Check if HTTP endpoints respond without authentication'}, {'type': 'list_item', 'content': 'curl -H "Origin: http://malicious-site.com" http://<target-ip>:3001/api/endpoint # Test permissive CORS policy'}, {'type': 'paragraph', 'content': 'Additionally, inspecting the server environment variables for unset AUTH_TOKEN and JWT_SECRET or if NODE_ENV is set to "development" can indicate the authentication bypass condition.'}] [1]

Useful 0 Not Useful 0

Mitigation Strategies

[{'type': 'paragraph', 'content': 'Immediate mitigation steps include:'}, {'type': 'list_item', 'content': 'Configure authentication by setting AUTH_TOKEN and JWT_SECRET environment variables to enforce credential checks.'}, {'type': 'list_item', 'content': 'Remove or restrict the NODE_ENV "development" mode when the server is accessible on the network.'}, {'type': 'list_item', 'content': 'Apply authentication middleware to WebSocket endpoints and verify user ownership of invocation UUIDs.'}, {'type': 'list_item', 'content': 'Restrict CORS policy to allow only trusted frontend origins instead of allowing any origin.'}, {'type': 'list_item', 'content': 'Firewall or restrict network exposure by preventing the server from binding to 0.0.0.0 without protection, ideally binding to localhost (127.0.0.1) if remote access is not needed.'}] [1]

Useful 0 Not Useful 0