CVE-2026-109437 Details
Description
Cognition before 0.13.0 contains an unauthenticated remote code execution vulnerability due to defaulting its agent sandbox backend to local execution and shipping no authentication on its REST/SSE API. Attackers can create a session via POST /sessions and post a message via POST /sessions/{id}/messages without credentials, causing the Deep Agents ReAct loop to run attacker-directed shell commands through the local shell backend, resulting in remote code execution as the server process.
A remote code execution vulnerability has been identified in Cognition versions prior to 0.13.0. This issue arises because the agent sandbox backend defaults to local execution and the REST/SSE API lacks authentication. Attackers can exploit this vulnerability by creating a session and sending messages that direct the AI agent to execute arbitrary shell commands on the host machine, using the local shell backend. The commands are executed as the server process, potentially accessing sensitive environment variables such as GH_TOKEN.
Upgrade Cognition to version 0.13.0 or later, where the local shell backend is disabled by default. Ensure that the Cognition API is not exposed directly and is instead behind an authentication gateway or reverse proxy.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 19, 2026CISA-ADP
Assessed Oct 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/CognicellAI/Cognition/releases/tag/v0.13.0 | [email protected] | Release NotesVendor |
| https://www.lasso.security/vulnerability-database/cve-2026-109437 | [email protected] | AdvisoryExploitRemedy |
| https://www.vulncheck.com/advisories/cognition-unauthenticated-rce-via-local-shell-backend | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1188 | Initialization of a Resource with an Insecure Default | [email protected] |
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| CognicellAI/Cognition | < 0.13.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 20, 2026 | CVE Modified | CISA-ADP |
| Oct 19, 2026 | New CVE Received | [email protected] |