CVE-2026-90601

Received Received - Intake

Improper Authentication in Getzep Graphiti REST API

Publication date: 2026-09-13

Last updated on: 2026-09-13

Assigner: VulDB

Description

A vulnerability was found in getzep graphiti up to 0.30.2. Affected is an unknown function of the file server/graph_service/main.py of the component REST API. The manipulation results in improper authentication. The attack can be launched remotely. The pull request to fix this issue awaits acceptance.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-13

Last Modified

2026-09-13

Generated

2026-09-14

AI Q&A

2026-09-14

EPSS Evaluated

N/A

NVD

CVE-2026-90601

EUVD

EUVD-2026-77130

Affected Vendors & Products

Vendor	Product	Version / Range
getzep	graphiti	to 0.30.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

This vulnerability is an improper authentication issue in the getzep graphiti software up to version 0.30.2. It exists in the REST API component, specifically in the server/graph_service/main.py file. The flaw allows remote attackers to bypass authentication mechanisms, potentially gaining unauthorized access to sensitive functions or data.

Impact Analysis

If exploited, this vulnerability could allow attackers to remotely access restricted API endpoints without proper credentials. This may lead to unauthorized data access, manipulation, or deletion, depending on the API's functionality. Systems using affected versions are at risk of security breaches.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations using affected software may face compliance violations, potential fines, and reputational damage due to inadequate access controls.

Mitigation Strategies

Update getzep graphiti to the latest version beyond 0.30.2 where the authentication issue is fixed. If an update is not available, apply the pending pull request fix manually. Restrict network access to the REST API component until patched.

Hi! I’m here to help you understand CVE-2026-90601. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70