{"id":"CVE-2026-75128","kind":"vulnerability","aliases":["CVE-2026-75128"],"related":[],"title":"Langchain-Chatchat: unauthenticated API lets anyone run OS commands","description":"Langchain-Chatchat through 0.3.1.3 exposes a POST /tools/call API endpoint that invokes any registered tool by name without authentication, leaving the always-registered shell tool callable. Remote attackers can send a single request naming the shell tool to execute arbitrary OS commands as the server user (root in the shipped Docker image).","summary":"Langchain-Chatchat through 0.3.1.3 exposes a POST /tools/call endpoint that runs any registered tool by name with no authentication. Because the shell tool is always registered, a remote attacker can send one request to execute arbitrary OS commands as the server user, which is root in the shipped Docker image.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"langchain-chatchat","fixed":[],"affected":"<= 0.3.1.3","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["ai-tooling","docker","langchain-chatchat","python","rce","self-hosted","unauthenticated"],"not_affected_if":["api-not-reachable","managed-hosting","tools-endpoint-blocked"],"how_to_check":"Run 'pip show langchain-chatchat' (or check the Docker image tag, e.g. chatimage/chatchat:0.3.1.2-2024-0720). Any version <=0.3.1.3 is affected. From another host, run: curl -s http://HOST:7861/tools. If it lists a 'shell' tool, you are exposed. Search proxy/API logs for POST /tools/call from unknown addresses; if found, treat the host and its keys as compromised.","fix":"No fixed release as of 2026-10-23 (PyPI latest 0.3.1.3). Mitigate: do not expose API port 7861; put it behind an authenticating reverse proxy that denies /tools and /tools/call; remove the shell tool (tools_factory/shell.py, @regist_tool) from the install; run the container as non-root and avoid network_mode host / 0.0.0.0 binding. Watch the repo and GHSA-5rx2-xp53-9x5r for a patch.","status":"open","published_at":"2026-10-20T01:17:19+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","triaged_at":"2026-10-23T22:39:43+00:00","updated_at":"2026-10-23T22:40:19+00:00","category":"ai-tooling","confidence":0.85,"triage":{"at":"2026-10-23T22:39:43Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Langchain-Chatchat: unauthenticated API lets anyone run OS commands","impact":"high","summary":"Langchain-Chatchat through 0.3.1.3 exposes a POST /tools/call endpoint that runs any registered tool by name with no authentication. Because the shell tool is always registered, a remote attacker can send one request to execute arbitrary OS commands as the server user, which is root in the shipped Docker image.","category":"ai-tooling","who_cares":["langchain-chatchat","self-hosted","docker","python"],"confidence":0.8,"needs_auth":"no","worst_case":"Remote attacker runs OS commands as root in the container","analyst_note":"Sources do not list a fixed version or a mitigation; confirm the first fixed release and whether the /tools/call route can be disabled, at the NVD entry and the project repository.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.00049,"input_tokens":3000,"output_tokens":380,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Sources do not list a fixed version or a mitigation; confirm the first fixed release and whether the /tools/call route can be disabled, at the NVD entry and the project repository.","search":"'-2026':12A,15A '-75128':13A,16A '/tools/call':41B,92C '0.3.1.3':37B,88C 'ai':21B 'ai-tool':20B 'alway':58B,107C 'always-regist':106C 'anyon':7A 'api':5A,93C 'arbitrari':69B,125C 'attack':62B,113C 'authent':52B,103C 'callabl':111C 'chatchat':3A,19A,26B,35B,86C 'command':10A,71B,127C 'cve':11A,14A 'docker':23B,82B,136C 'endpoint':42B,94C 'execut':68B,124C 'expos':38B,89C 'host':31B 'imag':83B,137C 'invok':96C 'langchain':2A,18A,25B,34B,85C 'langchain-chatchat':1A,17A,24B,33B,84C 'leav':104C 'let':6A 'name':49B,101C,119C 'one':65B 'os':9A,70B,126C 'post':40B,91C 'python':27B 'rce':28B 'regist':46B,59B,98C,108C 'remot':61B,112C 'request':66B,118C 'root':78B,132C 'run':8A,44B 'self':30B 'self-host':29B 'send':64B,115C 'server':74B,130C 'shell':55B,109C,121C 'ship':81B,135C 'singl':117C 'tool':22B,47B,56B,99C,110C,122C 'unauthent':4A,32B 'user':75B,131C 'without':102C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T01:17:19+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-75128","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75128","severity":null,"published_at":"2026-10-20T01:17:19+00:00","modified_at":"2026-10-20T20:06:37+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-75128:166","url":null,"severity":null,"published_at":"2026-10-23T22:05:07+00:00","modified_at":"2026-10-23T22:05:07+00:00","first_seen_at":"2026-10-23T22:05:07+00:00","fetched_at":"2026-10-23T22:05:07+00:00","note":"VulnCheck advisory + CVE record: <=0.3.1.3 affected. PyPI latest is 0.3.1.3 and GitHub releases stop at v0.3.1, so no fix exists. A tweet claiming 'patch to >=0.3.1.4' is unsupported: no such release on PyPI. PoC public in repo issues #5430/#5456/#5460 since Dec 2025, closed stale. No exploitation in the wild found."},{"source":"analyst","external_id":"CVE-2026-75128:275","url":null,"severity":null,"published_at":"2026-10-23T22:40:19+00:00","modified_at":"2026-10-23T22:40:19+00:00","first_seen_at":"2026-10-23T22:40:19+00:00","fetched_at":"2026-10-23T22:40:19+00:00","note":"Return visit: no new sources or documents. The re-triage at 22:39 had blanked how_to_check and fix, so I restored them from run 166. Still no fixed release (PyPI latest 0.3.1.3). Not changing severity or exploited."}],"documents":[{"id":1309,"url":"https://www.vulncheck.com/advisories/langchain-chatchat-through-0.3.1.3-unauthenticated-rce-via-tools-call-endpoint","title":"VulnCheck advisory: Langchain-Chatchat <= 0.3.1.3 unauthenticated RCE via /tools/call","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1310,"url":"https://github.com/chatchat-space/Langchain-Chatchat/issues/5430","title":"Issue #5430: RCE through /tools/call (PoC, closed stale, no fix)","kind":"poc","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":1311,"url":"https://pypi.org/pypi/langchain-chatchat/json","title":"PyPI langchain-chatchat: latest 0.3.1.3, no later release","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1312,"url":"https://dev.to/actionable-vectors/no-prompt-injection-required-langchain-chatchats-toolscall-is-a-remote-shell-8c5","title":"No prompt injection required: Langchain-Chatchat's /tools/call is a remote shell","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"discussion","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}