medium4.8
CVE-2026-57476
Deloitte AI Assist for Customer exposed unauthenticated API endpoints that allowed an attacker with knowledge of additional parameters to read from or inject c…
Impact
Deloitte AI Assist for Customer exposed unauthenticated API endpoints that allowed an attacker with knowledge of additional parameters to read from or inject content into the retrieval-augmented generation (RAG) corpus. On 2026-03-25, AI Assist for Customer restricted network access and enforced authentication for the previously exposed endpoints.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Deloitte | Ai Assist For Customer | before 2026-03-25 |
Weakness classification
References
- NVD record
- CVE.org record
- https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-191-01.json
- https://www.cve.org/CVERecord?id=CVE-2026-57476
- https://zerotolerance.me/advisories/assets/VU487875-deloitte-ascend-advisory.pdf
- https://zerotolerance.me/advisories/deloitte-aiassist-ascend-2026-vu487875/