CognicellAI Cognition: Unauthenticated remote code execution via local shell backend

Summary

Cognition, a self-hosted AI agent server built on LangChain's Deep Agents framework, exposes its REST/SSE API without authentication. In the default configuration the agent runs on a local shell backend, so an unauthenticated attacker who can reach the server can create a session and post a message that makes the agent execute arbitrary shell commands as the server process. No credentials or user interaction are required, and the backend passes through credentials such as GH_TOKEN to executed commands.

Affected

• CognicellAI Cognition versions before 0.13.0
• Default configuration (local sandbox backend, no authentication)

Fixed in

• Version 0.13.0 and later

Workaround

• Do not set COGNITION_ALLOW_UNSAFE_LOCAL_EXECUTION=true outside isolated development; the setting defaults to false in 0.13.0
• Place the Cognition API behind an authenticating gateway or reverse proxy and do not expose port 8000 directly
• Require human approval for the execute (shell) tool or block it on agents that process untrusted input

Exploitation

• CISA SSVC: exploitation status PoC, automatable: no, technical impact: total
• A proof-of-concept script is referenced by the Lasso advisory; not independently verified
• No known exploitation in the wild found at the time of research; not listed in the CISA KEV catalog as of the last update

Our recommendation

• Check whether Cognition is deployed in your environment, including test and development systems
• Upgrade to Cognition 0.13.0 or later
• Until the upgrade is done, take exposed instances off the network or put them behind authentication
• Remove COGNITION_ALLOW_UNSAFE_LOCAL_EXECUTION=true from deployments based on the Docker Compose quick start
• Monitor logs for unexpected POST /sessions requests and for shell command activity by the server process
• Treat internet-reachable or untrusted-network instances as urgent

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Cognition v0.13.0 release (GitHub) github.com
• Lasso Security vulnerability database entry www.lasso.security
• VulnCheck advisory: Cognition unauthenticated RCE via local shell backend www.vulncheck.com
• HOL Guard CVE entry hol.org
• OpenCVE CVE entry app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 04:16.