What happened
Yuxi is a large-model-based intelligent knowledge base and knowledge graph agent development platform. Prior to version 0.6.2, CVE-2026-50561 (CVSS 9.4, Critical) describes insufficient validation of the identity token in the Authorization header, allowing authentication bypass.
Why it matters
A critical auth-bypass in an agent development platform built on knowledge graphs and LLMs exposes any deployed knowledge-base agent to unauthorized access, letting attackers read or manipulate the underlying knowledge graph and agent configuration without valid credentials.
Attack vector
Attacker sends a request with a malformed/insufficiently-validated Authorization header token, bypassing identity checks to gain unauthorized access to the knowledge-graph agent platform
Affected systems
Yuxi (xerrors/Yuxi) < 0.6.2
Mitigation
Upgrade to Yuxi 0.6.2 or later