Cognition Agent Server Before 0.13.0 Lets Anyone on the Network Run Shell Commands (CVE-2026-109437)

Operators of Cognition, the self-hosted AI agent server from CognicellAI, should upgrade to 0.13.0. Every earlier version defaults to running agent commands directly on the host and exposes a REST/SSE API with no authentication. Anyone who can reach the server can get it to execute shell commands as the server process. The flaw is tracked as CVE-2026-109437, a VulnCheck-assigned record published on 19 October 2026.

What is affected

All Cognition releases before 0.13.0. Cognition is built on LangChain's Deep Agents framework and is meant to be run by teams on their own infrastructure, so exposure depends on who can reach the API. Any deployment reachable from an untrusted network is at risk, and so is one reachable only from a shared internal network.

How it works

Two defaults combine. The agent sandbox backend defaults to local execution, so model-directed commands run on the host, and the REST/SSE API has no authentication. An attacker creates a session, then posts a message that makes the agent run attacker-chosen shell commands. Lasso Security, which describes the flaw as an ungated shell tool, adds that credentials the backend passes through, such as GH_TOKEN, are reachable by the same route. It also says session scoping is off by default and relies on self-asserted headers. No user interaction is needed.

The CVE record lists CWE-1188 (insecure default initialization) and CWE-306 (missing authentication for a critical function). It scores 9.2 under CVSS 4.0 and 9.8 under CVSS 3.1, both Critical. The CISA ADP entry rates exploitation as PoC, automatable as No, and technical impact as Total. Lasso lists no known exploit. The researchers credited are Noy Pearl, Michael Sromin and Ophir Dror.

One unauthenticated API call to a reachable Cognition server ends in shell commands on the host and exposed credentials such as GH_TOKEN.

The fix

According to the CVE record, 0.13.0 refuses the local sandbox backend unless COGNITION_ALLOW_UNSAFE_LOCAL_EXECUTION is set to true, and the default is false. The release notes, dated 27 July 2026 in the changelog and published 28 July, describe the change more generally: strict production settings reject host-local execution and sandbox fallback, and exceptions need explicit development flags. They do not name that variable, and they describe no change to authentication. They put tenant authorization with the builder or operator.

The upgrade is not drop-in. In 0.13.0:

• The implicit default agent is gone, so agents must be provisioned explicitly.
• POST /sessions now requires an agent_name.
• Writes must be drained before the migration, because mixed v0.12 and v0.13 writers are unsupported.
• cognition db upgrade and cognition db current ship in the release image.

What defenders should do

1. Upgrade to 0.13.0 or later, following the migration notes above.
2. Do not set COGNITION_ALLOW_UNSAFE_LOCAL_EXECUTION=true on anything reachable by others.
3. Put the API behind your own authentication, such as a reverse proxy or network policy, because the release notes describe no built-in authentication change.
4. On instances that ran an affected version while reachable, review session and run history for unexpected sessions and shell commands, and rotate credentials the process could read, including GH_TOKEN.

Sources

• CVE record: https://cveawg.mitre.org/api/cve/CVE-2026-109437
• VulnCheck advisory: https://www.vulncheck.com/advisories/cognition-unauthenticated-rce-via-local-shell-backend
• Lasso Security: https://www.lasso.security/vulnerability-database/cve-2026-109437
• Cognition v0.13.0 release: https://github.com/CognicellAI/Cognition/releases/tag/v0.13.0