CVE-2025-27518 Cognita CORS misconfiguration in backend API server
Insecure CORS configuration in Cognita backend allows arbitrary websites to send cross-site requests, bypassing same-origin policy restrictions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-27518?
CVE-2025-27518 is a medium-severity vulnerability in truefoundry cognita, published on 7 Mar 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Cognita is a RAG (Retrieval Augmented Generation) Framework for building modular, open source applications for production by TrueFoundry. An insecure CORS configuration in the Cognita backend server allows arbitrary websites to send cross site requests to the application. This vulnerability is fixed in commit 75079c3d3cf376381489b9a82ee46c69024e1a15.
Weakness: CWE-79
Which versions are affected by CVE-2025-27518?
How do I fix CVE-2025-27518?
No fix has been published for CVE-2025-27518 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-27518 being exploited?
There is no known exploitation of CVE-2025-27518 in the wild and no public exploit code.