Vulnerability · Published Jun 8, 2026 · Assigned by VulDB
CVE-2026-11479yoanbernabeu grepai Qdrant Backend chunker.go weak hash
Medium 4.2
In plain English
A medium-severity broken cryptography in grepai from yoanbernabeu. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities).
Official description
A vulnerability has been found in yoanbernabeu grepai 0.35.0. This issue affects some unknown processing of the file indexer/chunker.go of the component Qdrant Backend. Such manipulation leads to use of weak hash. The attack may be performed from remote. Attacks of this nature are highly complex. The exploitability is assessed as difficult. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/yoanbernabeu/grepai | no fix listed | GHSA-6h35-9p2w-3j3r |
| Go | github.com/yoanbernabeu/grepai | no fix listed | GO-2026-6125 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| yoanbernabeu | grepai | 0.35.0 |
Weakness: CWE-328, CWE-327 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R
References
- VDB-369099 | yoanbernabeu grepai Qdrant Backend chunker.go weak hash vdb-entry
- VDB-369099 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- CVE-2026-11479 | CVE Analysis and Report third-party-advisory
- Submit #833971 | yoanbernabeu grepai 0.35.0 Improper Isolation third-party-advisory
- https://github.com/yoanbernabeu/grepai/issues/247 exploit, issue-tracking
- https://github.com/yoanbernabeu/grepai/pull/248 issue-tracking, patch
- https://github.com/yoanbernabeu/grepai/ product