CVE-2026-11479: yoanbernabeu grepai Qdrant Backend chunker.go weak hash

Severity: medium (CVSS 4.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-08 · updated 2026-07-23
Weakness: CWE-327

Description

A vulnerability has been found in yoanbernabeu grepai 0.35.0. This issue affects some unknown processing of the file indexer/chunker.go of the component Qdrant Backend. Such manipulation leads to use of weak hash. The attack may be performed from remote. Attacks of this nature are highly complex. The exploitability is assessed as difficult. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance.

Affected products

yoanbernabeu grepai: 0.35.0

References

https://github.com/yoanbernabeu/grepai/
https://github.com/yoanbernabeu/grepai/issues/247
https://github.com/yoanbernabeu/grepai/pull/248
https://vuldb.com/cve/CVE-2026-11479
https://vuldb.com/submit/833971
https://vuldb.com/vuln/369099
https://vuldb.com/vuln/369099/cti

Get alerted when CVE-2026-11479 or the next vulnerability affects your stack