PT-2026-29679

CVE-2026-5320

Published

2026-04-02

Updated

2026-04-27

Description by

CVSS 2.0

7.5

High

MetricsAV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions vanna-ai vanna versions up to 2.0.2

Description A security issue exists in vanna-ai vanna, specifically within the Chat API Endpoint component. A manipulation of the /api/vanna/v2/ file results in missing authentication. This can be exploited remotely. The exploit is publicly available.

Recommendations Update to a version beyond 2.0.2.

Exploitability

Exploit

Fix

Impacts

Researchers

Vuldb

Yu_Bao

Vendors

Affected products

Weakness enumeration

CWE-287: Improper Authentication