CVE-2026-6977 is a high-severity authorization bypass vulnerability in the Legacy Flask API component of vanna-ai/vanna, affecting all versions through 2.0.2. Unauthenticated remote attackers can bypass access controls to interact with protected API endpoints, potentially accessing or manipulating AI query functionality and underlying data. A public exploit has been disclosed. No official patch exists at this time.