CVE-2026-109437: Cognition < 0.13.0 Unauthenticated RCE via Local Shell Backend
Cognition before 0.13.0 contains an unauthenticated remote code execution vulnerability due to defaulting its agent sandbox backend to local execution and shipping no authentication on its REST/SSE API. Attackers can create a session via POST /sessions and post a message via POST /sessions/{id}/messages without credentials, causing the Deep Agents ReAct loop to run attacker-directed shell commands through the local shell backend, resulting in remote code execution as the server process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Cognitionto a version that resolves this vulnerability.Fixed in 0.13.0 - Configuration
Keep COGNITION_ALLOW_UNSAFE_LOCAL_EXECUTION set to false or unset; do not explicitly set it to true.
Cognition local sandbox backend COGNITION_ALLOW_UNSAFE_LOCAL_EXECUTION = false
Event History
Frequently Asked Questions
Which deployments are exposed?
Cognition deployments running a version before 0.13.0 are exposed when their REST/SSE API is reachable by an attacker. The vulnerable configuration uses the local execution backend by default and provides no API authentication.
What does an attacker need to exploit this issue?
No credentials or user interaction are required. An attacker can create a session through POST /sessions and submit a message through POST /sessions/{id}/messages to direct shell commands through the agent loop.
What level of access could successful exploitation provide?
Successful exploitation executes attacker-directed shell commands as the Cognition server process. This can compromise the confidentiality, integrity, and availability of resources accessible to that process.
How can I determine whether my instance is affected?
Verify whether the deployed Cognition version is earlier than 0.13.0 and whether its REST/SSE API accepts session creation and message submission without credentials. Instances using the default local shell backend meet the vulnerable condition described.
What should be prioritized for remediation?
Upgrade Cognition to version 0.13.0 or later. Until upgrading is possible, prevent untrusted network access to the REST/SSE API, since the affected API endpoints do not require credentials.