CVE-2026-5321: vanna-ai vanna FastAPI/Flask Server cross-domain policy
A flaw has been found in vanna-ai vanna up to 2.0.2. Affected by this issue is some unknown functionality of the component FastAPI/Flask Server. Executing a manipulation can lead to permissive cross-domain policy with untrusted domains. The attack can be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-5321?
CVE-2026-5321 has been classified as a high severity vulnerability due to its potential to allow untrusted domains access through a permissive cross-domain policy.
How do I fix CVE-2026-5321?
To fix CVE-2026-5321, upgrade vanna-ai vanna to a version higher than 2.0.2 to mitigate the cross-domain policy flaw.
What components are affected by CVE-2026-5321?
CVE-2026-5321 affects the FastAPI/Flask Server functionalities within vanna-ai vanna versions up to and including 2.0.2.
What risks does CVE-2026-5321 pose to users?
CVE-2026-5321 can lead to security risks by allowing untrusted domains to execute potentially malicious scripts or access sensitive data.
When was CVE-2026-5321 disclosed?
CVE-2026-5321 was disclosed recently and affects versions of vanna-ai vanna prior to 2.0.3.