AnythingLLM versions before 1.10.0 expose the Qdrant API key in plain text through the /api/setup-complete endpoint when the application is configured to use Qdrant. The exposed key grants attackers full read and write rights to the Qdrant vector database, which often holds the core knowledge base for retrieval-augmented generation. This vulnerability enables an unauthenticated attacker to compromise the semantic search functionality, exfiltrate uploaded documents, and potentially tamper with the system’s data integrity. The weakness corresponds to CWE‑201, an improper restriction of actions on a resource with local privileges.

The affected system is AnythingLLM from Mintplex‑Labs, any version prior to 1.10.0 that uses Qdrant as the vector database and has an API key configured. The issue applies to all deployments where the /api/setup-complete endpoint is publicly accessible.

With a CVSS score of 8.7 the vulnerability is considered high severity. The EPSS score of 11% indicates a moderate likelihood of exploitation in the near future. The vulnerability is not listed in CISA’s KEV catalog, but the exposure of database credentials enables direct remote compromise of the underlying data store and potentially the application. Attackers can exploit the issue simply by requesting the /api/setup-complete endpoint, which can be done from any network without authentication. If the API key is valid, they immediately gain write and read capabilities on the database.