CVE-2025-61164: WebSocket leak exposes

CISO Take

Cohere North AI v1.1.5, Cohere's enterprise agentic AI platform, exposes an information leak through its WebSocket endpoint, allowing data intended for one session or user to be read by an unauthorized party. No CVSS score, EPSS percentile, or CISA KEV status has been assigned yet, and there is no known public exploit script or Nuclei scanner template, so this has not been weaponized at scale as of publication. That said, North is positioned as an agentic platform handling internal workflows and potentially sensitive enterprise data, so a working WebSocket-layer leak in that context carries real confidentiality risk even without a severity score attached. Security teams running Cohere North should confirm their deployed version, check vendor channels for a patched release beyond 1.1.5, and in the interim restrict or monitor access to the WebSocket endpoint (network segmentation, auth-in-front-of-proxy, connection logging) until a fix is confirmed. Treat this as a watch item rather than a fire drill given the current lack of exploitation evidence.

Sources: NVD cohere.com ATLAS GitHub

What is the risk?

Severity is currently unrated (no CVSS/EPSS/KEV data), which limits precise risk scoring, but the vulnerability class — an information leak on a real-time WebSocket channel in an enterprise agentic AI platform — is inherently concerning because such channels often carry live session state, conversation content, or agent tool outputs. Exploitability appears to require network access to the endpoint and no user interaction is implied by the description, which would normally push likelihood upward, but the absence of a public PoC beyond the disclosure write-up and no scanner coverage keeps near-term mass-exploitation risk low. Organizations running multi-tenant or shared North deployments should treat this as higher priority than the missing CVSS score suggests, since data leakage on session channels can silently expose one customer's or user's data to another.

How does the attack unfold?

Initial Access

Attacker connects to the Cohere North AI WebSocket endpoint, which lacks adequate access controls or session isolation.

AML.T0049

Exploitation

The endpoint streams session or interaction data to the connected client without properly scoping it to the authorized user.

AML.T0057

Impact

Attacker obtains sensitive conversation, agent, or session data belonging to other users or tenants of the North deployment.

AML.T0024

Initial Access

Attacker connects to the Cohere North AI WebSocket endpoint, which lacks adequate access controls or session isolation.

AML.T0049

Exploitation

The endpoint streams session or interaction data to the connected client without properly scoping it to the authorized user.

AML.T0057

Impact

Attacker obtains sensitive conversation, agent, or session data belonging to other users or tenants of the North deployment.

AML.T0024

How severe is it?

CVSS 3.1

N/A

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Moderate

What should I do?

1 step

1) Confirm the exact Cohere North AI version in use and check vendor advisories/release notes for a fix beyond 1.1.5. 2) Until patched, restrict WebSocket endpoint exposure to trusted networks only (VPN/allowlist), and place it behind an authenticating reverse proxy if not already enforced. 3) Enable and review connection/audit logs on the WebSocket endpoint to detect anomalous or cross-session access patterns. 4) Rotate any session tokens or credentials that may have traversed the channel if compromise is suspected. 5) Track this CVE for an official patch and re-test the endpoint post-patch to confirm session isolation is enforced.

How is it classified?

Data Leakage Auth Bypass Agent API AML.T0024 - Exfiltration via AI Inference API AML.T0049 - Exploit Public-Facing Application AML.T0057 - LLM Data Leakage

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

Annex A.6.2 - AI system security

NIST AI RMF

MEASURE 2.7 - AI system security and resilience

OWASP LLM Top 10

LLM06 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2025-61164?

Cohere North AI v1.1.5, Cohere's enterprise agentic AI platform, exposes an information leak through its WebSocket endpoint, allowing data intended for one session or user to be read by an unauthorized party. No CVSS score, EPSS percentile, or CISA KEV status has been assigned yet, and there is no known public exploit script or Nuclei scanner template, so this has not been weaponized at scale as of publication. That said, North is positioned as an agentic platform handling internal workflows and potentially sensitive enterprise data, so a working WebSocket-layer leak in that context carries real confidentiality risk even without a severity score attached. Security teams running Cohere North should confirm their deployed version, check vendor channels for a patched release beyond 1.1.5, and in the interim restrict or monitor access to the WebSocket endpoint (network segmentation, auth-in-front-of-proxy, connection logging) until a fix is confirmed. Treat this as a watch item rather than a fire drill given the current lack of exploitation evidence.

Is CVE-2025-61164 actively exploited?

No confirmed active exploitation of CVE-2025-61164 has been reported, but organizations should still patch proactively.

How to fix CVE-2025-61164?

1) Confirm the exact Cohere North AI version in use and check vendor advisories/release notes for a fix beyond 1.1.5. 2) Until patched, restrict WebSocket endpoint exposure to trusted networks only (VPN/allowlist), and place it behind an authenticating reverse proxy if not already enforced. 3) Enable and review connection/audit logs on the WebSocket endpoint to detect anomalous or cross-session access patterns. 4) Rotate any session tokens or credentials that may have traversed the channel if compromise is suspected. 5) Track this CVE for an official patch and re-test the endpoint post-patch to confirm session isolation is enforced.

What systems are affected by CVE-2025-61164?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines.

What is the CVSS score for CVE-2025-61164?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworksRAG pipelines

MITRE ATLAS Techniques

AML.T0024 Exfiltration via AI Inference API

AML.T0049 Exploit Public-Facing Application

AML.T0057 LLM Data Leakage

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: Annex A.6.2

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

Cohere North AI v1.1.5 was discovered to contain an information leak via the WebSocket Endpoint.

Exploitation Scenario

An attacker with network reachability to the Cohere North AI WebSocket endpoint connects to it — potentially without needing to authenticate as the target user — and receives data streamed over the socket that belongs to another active session, such as conversation content, agent outputs, or internal metadata. Because WebSocket connections are long-lived and often used for real-time agent-to-user updates, the leak could passively expose a continuous stream of sensitive interactions rather than a single request/response, making it attractive for reconnaissance or credential/session harvesting within an enterprise deployment.