CVE-2026-109437

9.8Critical

Published 19 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

9.8Critical

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-306, CWE-1188

Impact

Unauthenticated attackers can execute arbitrary shell commands as the server process with simple network access to the API. They only need to send unauthenticated HTTP POST requests to the /sessions and /sessions/{id}/messages endpoints.

Root cause

The REST/SSE API lacks authentication and defaults the agent execution sandbox to the local shell backend.

Affected systems

Cognition versions prior to 0.13.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade to Cognition 0.13.0 or higher. If upgrading must wait, block external network access to the API endpoints (/sessions) or restrict network traffic using a reverse proxy or firewall.

shell

$ pip install --upgrade cognition

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Cognition before 0.13.0 contains an unauthenticated remote code execution vulnerability due to defaulting its agent sandbox backend to local execution and shipping no authentication on its REST/SSE API. Attackers can create a session via POST /sessions and post a message via POST /sessions/{id}/messages without credentials, causing the Deep Agents ReAct loop to run attacker-directed shell commands through the local shell backend, resulting in remote code execution as the server process.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109437