CVE-2026-6977

HIGH

vanna-ai vanna Legacy Flask API improper authorization

Title source: cna

Description

A security vulnerability has been detected in vanna-ai vanna up to 2.0.2. The affected element is an unknown function of the component Legacy Flask API. The manipulation leads to improper authorization. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

References (4)

[Vdb Entry] https://vuldb.com/vuln/359520

[Signature, Permissions Required] https://vuldb.com/vuln/359520/cti

[Third Party Advisory] https://vuldb.com/submit/795331

[Exploit] https://github.com/yidaozhongqing/York/issues/2

Scores

CVSS v3 7.3

EPSS 0.0004

EPSS Percentile 11.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation poc

Automatable yes

Technical Impact partial

Details

CWE

CWE-266 CWE-285

Status published

Products (3)

vanna-ai/vanna 2.0.0

vanna-ai/vanna 2.0.1

vanna-ai/vanna 2.0.2

Published Apr 25, 2026

Tracked Since Apr 25, 2026