A ready-made attack for a flaw in Zylon PrivateGPT is now public
KROMSE explanation
Zylon PrivateGPT has a security flaw (CVE-2026-116000, CVSS 6.9). The official record says: A security flaw has been discovered in Zylon PrivateGPT 1.0.0/1.0.1. This vulnerability affects the function load_file_from_uri of the file private_gpt/server/ingest/uri_loader.py of the component URI Artifact Loader.
Not confirmed yet, but attack code is public, so attacks often follow within days.
Anyone running Zylon PrivateGPT.
- Install the maker's update for Zylon PrivateGPT as soon as it is out.
- Not sure if you use it? KROMSE can check your product for free.
