---
id: "CVE-2026-75128"
kind: "vulnerability"
aliases: ["CVE-2026-75128"]
title: "Langchain-Chatchat: unauthenticated API lets anyone run OS commands"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "langchain-chatchat", "fixed": [], "affected": "<= 0.3.1.3", "ecosystem": "pypi"}]
ecosystems: ["pypi"]
tags: ["ai-tooling", "docker", "langchain-chatchat", "python", "rce", "self-hosted", "unauthenticated"]
not_affected_if: ["api-not-reachable", "managed-hosting", "tools-endpoint-blocked"]
published_at: "2026-10-20T01:17:19+00:00"
first_seen_at: "2026-10-23T21:57:19+00:00"
updated_at: "2026-10-23T22:40:19+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75128", "first_seen_at": "2026-10-23T21:57:19+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:05:07+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:40:19+00:00"}]
---

# Langchain-Chatchat: unauthenticated API lets anyone run OS commands

Langchain-Chatchat through 0.3.1.3 exposes a POST /tools/call endpoint that runs any registered tool by name with no authentication. Because the shell tool is always registered, a remote attacker can send one request to execute arbitrary OS commands as the server user, which is root in the shipped Docker image.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:langchain-chatchat affected <= 0.3.1.3 fixed ?

## How to check

Run 'pip show langchain-chatchat' (or check the Docker image tag, e.g. chatimage/chatchat:0.3.1.2-2024-0720). Any version <=0.3.1.3 is affected. From another host, run: curl -s http://HOST:7861/tools. If it lists a 'shell' tool, you are exposed. Search proxy/API logs for POST /tools/call from unknown addresses; if found, treat the host and its keys as compromised.

## Fix

No fixed release as of 2026-10-23 (PyPI latest 0.3.1.3). Mitigate: do not expose API port 7861; put it behind an authenticating reverse proxy that denies /tools and /tools/call; remove the shell tool (tools_factory/shell.py, @regist_tool) from the install; run the container as non-root and avoid network_mode host / 0.0.0.0 binding. Watch the repo and GHSA-5rx2-xp53-9x5r for a patch.

## Timeline

- 2026-10-23T21:57:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-75128
- 2026-10-23T22:05:07+00:00 analyst — VulnCheck advisory + CVE record: <=0.3.1.3 affected. PyPI latest is 0.3.1.3 and GitHub releases stop at v0.3.1, so no fix exists. A tweet claiming 'patch to >=0.3.1.4' is unsupported: no such release on PyPI. PoC public in repo issues #5430/#5456/#5460 since Dec 2025, closed stale. No exploitation in the wild found.
- 2026-10-23T22:40:19+00:00 analyst — Return visit: no new sources or documents. The re-triage at 22:39 had blanked how_to_check and fix, so I restored them from run 166. Still no fixed release (PyPI latest 0.3.1.3). Not changing severity or exploited.

## Documents

- [advisory] VulnCheck advisory: Langchain-Chatchat <= 0.3.1.3 unauthenticated RCE via /tools/call https://www.vulncheck.com/advisories/langchain-chatchat-through-0.3.1.3-unauthenticated-rce-via-tools-call-endpoint
- [describes] PyPI langchain-chatchat: latest 0.3.1.3, no later release https://pypi.org/pypi/langchain-chatchat/json
- [discussion] No prompt injection required: Langchain-Chatchat's /tools/call is a remote shell https://dev.to/actionable-vectors/no-prompt-injection-required-langchain-chatchats-toolscall-is-a-remote-shell-8c5
- [poc] Issue #5430: RCE through /tools/call (PoC, closed stale, no fix) https://github.com/chatchat-space/Langchain-Chatchat/issues/5430

## From the sources

Langchain-Chatchat through 0.3.1.3 exposes a POST /tools/call API endpoint that invokes any registered tool by name without authentication, leaving the always-registered shell tool callable. Remote attackers can send a single request naming the shell tool to execute arbitrary OS commands as the server user (root in the shipped Docker image).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_