{"id":"CVE-2026-109437","kind":"vulnerability","aliases":["CVE-2026-109437"],"related":[],"title":"Cognition: unauthenticated API lets remote users run shell commands","description":"Cognition before 0.13.0 contains an unauthenticated remote code execution vulnerability due to defaulting its agent sandbox backend to local execution and shipping no authentication on its REST/SSE API. Attackers can create a session via POST /sessions and post a message via POST /sessions/{id}/messages without credentials, causing the Deep Agents ReAct loop to run attacker-directed shell commands through the local shell backend, resulting in remote code execution as the server process.","summary":"Cognition before 0.13.0 ships its REST/SSE API with no authentication and defaults its agent sandbox to local execution. An attacker who can reach the API can create a session, send a message, and have the agent run shell commands as the server process.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"CognicellAI/Cognition","fixed":["0.13.0"],"affected":"< 0.13.0","ecosystem":"github"}],"ecosystems":["github"],"tags":["ai-agents","ai-tooling","cognition","deep-agents","mcp-adjacent","self-hosted"],"not_affected_if":["api-not-exposed","version-0.13.0-or-later"],"how_to_check":"Check the installed Cognition version; versions below 0.13.0 are affected. Confirm whether the API port is reachable from untrusted networks.","fix":"Upgrade Cognition to 0.13.0 or later. Until then, block external access to the API and do not run the local shell backend on a shared host.","status":"open","published_at":"2026-10-19T19:17:19+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-23T22:39:56+00:00","updated_at":"2026-10-23T22:39:56+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-23T22:39:56Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Cognition to 0.13.0 or later. Until then, block external access to the API and do not run the local shell backend on a shared host.","reach":"internet","title":"Cognition: unauthenticated API lets remote users run shell commands","impact":"high","summary":"Cognition before 0.13.0 ships its REST/SSE API with no authentication and defaults its agent sandbox to local execution. An attacker who can reach the API can create a session, send a message, and have the agent run shell commands as the server process.","category":"ai-tooling","who_cares":["cognition","deep-agents","self-hosted","ai-agents"],"confidence":0.8,"needs_auth":"no","worst_case":"Remote attacker runs arbitrary commands as the Cognition server process.","analyst_note":"Confirm the 0.13.0 fix changes the default sandbox backend and adds auth on /sessions; check the GitHub advisory at github.com/CognicellAI/Cognition for exact fix details.","how_to_check":"Check the installed Cognition version; versions below 0.13.0 are affected. Confirm whether the API port is reachable from untrusted networks.","needs_analyst":true,"not_affected_if":["version-0.13.0-or-later","api-not-exposed"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000537,"input_tokens":3034,"output_tokens":467,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the affected package name, registry and version range, and whether a published fix or advisory exists beyond the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-109437).","search":"'-109437':12A,15A '-2026':11A,14A '/messages':120C '/sessions':111C,118C '0.13.0':35B,78C 'adjac':29B 'agent':19B,26B,46B,68B,90C,126C 'ai':18B,21B 'ai-ag':17B 'ai-tool':20B 'api':3A,39B,57B,103C 'attack':52B,104C,132C 'attacker-direct':131C 'authent':42B,99C 'backend':92C,140C 'caus':123C 'code':83C,144C 'cognicellai/cognition':16A 'cognit':1A,23B,33B,76C 'command':9A,71B,135C 'contain':79C 'creat':59B,106C 'credenti':122C 'cve':10A,13A 'deep':25B,125C 'deep-ag':24B 'default':44B,88C 'direct':133C 'due':86C 'execut':50B,84C,95C,145C 'host':32B 'id':119C 'let':4A 'local':49B,94C,138C 'loop':128C 'mcp':28B 'mcp-adjac':27B 'messag':64B,115C 'post':110C,113C,117C 'process':75B,149C 'reach':55B 'react':127C 'remot':5A,82C,143C 'rest/sse':38B,102C 'result':141C 'run':7A,69B,130C 'sandbox':47B,91C 'self':31B 'self-host':30B 'send':62B 'server':74B,148C 'session':61B,108C 'shell':8A,70B,134C,139C 'ship':36B,97C 'tool':22B 'unauthent':2A,81C 'user':6A 'via':109C,116C 'vulner':85C 'without':121C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T19:17:19+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109437","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109437","severity":null,"published_at":"2026-10-19T19:17:19+00:00","modified_at":"2026-10-20T17:17:28+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-109437:231","url":null,"severity":null,"published_at":"2026-10-23T22:28:34+00:00","modified_at":"2026-10-23T22:28:34+00:00","first_seen_at":"2026-10-23T22:28:34+00:00","fetched_at":"2026-10-23T22:28:34+00:00","note":"Lasso Security advisory (researchers' own write-up, with PoC steps) and VulnCheck CNA record read; fix v0.13.0 per both. No public chatter on X; exploited in the wild not reported (KEV no). Lasso's PoC is a local harness; I did not retrieve the repo release page, so the fix tag was not read directly."}],"documents":[{"id":1462,"url":"https://www.lasso.security/vulnerability-database/cve-2026-109437","title":"Lasso Security: CVE-2026-109437 Unauthenticated RCE via Local Shell Backend","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1463,"url":"https://www.vulncheck.com/advisories/cognition-unauthenticated-rce-via-local-shell-backend","title":"VulnCheck: Cognition < 0.13.0 Unauthenticated RCE","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1464,"url":"https://theinjection.dev/items/lasso-agent-platform-shell-tool-cves/","title":"Lasso Security: five agent platforms ship an ungated shell tool","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}