CVE-2026-109437

Description

Cognition before 0.13.0 contains an unauthenticated remote code execution vulnerability due to defaulting its agent sandbox backend to local execution and shipping no authentication on its REST/SSE API. Attackers can create a session via POST /sessions and post a message via POST /sessions/{id}/messages without credentials, causing the Deep Agents ReAct loop to run attacker-directed shell commands through the local shell backend, resulting in remote code execution as the server process.

Severity scores

Each score is shown as its source gave it. They are not averaged or merged.

• 9.2CVSS 4.0, Criticalfrom the CNA (VulnCheck)CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
• 9.8CVSS 3.1, Criticalfrom the CNA (VulnCheck)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What to do

• Upgrade to Cognition 0.13.0 or later. Version 0.13.0 refuses the local sandbox backend unless COGNITION_ALLOW_UNSAFE_LOCAL_EXECUTION is explicitly set to true, and that setting defaults to false.CNA solution statement

Historical context and remediation

This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.

No separately sourced impact summary is available on this page yet. Consult the description, version data and dated exploitation evidence.

Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.

Read the original CVE record.

Affected products

Timeline

1. 19 Oct 2026 Published

Weakness

• CWE-1188
• CWE-306

References

• Lasso.security Advisorytechnical-descriptionexploit
• Cognition v0.13.0 Release Notesrelease-notespatch
• VulnCheck Advisory: Cognition < 0.13.0 Unauthenticated RCE via Local Shell Backendthird-party-advisory