CVE-2026-75128: Langchain-Chatchat through 0.3.1.3 Unauthenticated RCE via /tools/call Endpoint

Q: Who is exposed to exploitation?

Any reachable Langchain-Chatchat instance through version 0.3.1.3 is exposed if its POST /tools/call endpoint is accessible to a remote attacker. No authentication, privileges, or user interaction are required.

Q: Is the default deployment affected?

Yes. The shell tool is always registered, so it can be invoked through the unauthenticated endpoint. In the shipped Docker image, commands execute as root.

Q: What does an attacker need to exploit this issue?

An attacker needs only network access to the POST /tools/call endpoint and can send a single request that names the shell tool. This allows arbitrary operating-system commands to run as the server user.

Q: How can I reduce exposure if I cannot patch immediately?

Restrict network access to the /tools/call endpoint so untrusted remote users cannot reach it. This is particularly urgent for deployments using the shipped Docker image because command execution occurs as root.

Published Oct 20, 2026

Updated

Langchain-Chatchat through 0.3.1.3 exposes a POST /tools/call API endpoint that invokes any registered tool by name without authentication, leaving the always-registered shell tool callable. Remote attackers can send a single request naming the shell tool to execute arbitrary OS commands as the server user (root in the shipped Docker image).

Affected Software

1 affected component

Langchain-Chatchat Langchain-Chatchat<=0.3.1.3

Event History

Oct 20, 2026

CVE Published

via MITRE·12:46 AM

Data Sourced

via MITRE·12:46 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·01:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to exploitation?

Any reachable Langchain-Chatchat instance through version 0.3.1.3 is exposed if its POST /tools/call endpoint is accessible to a remote attacker. No authentication, privileges, or user interaction are required.

Is the default deployment affected?

Yes. The shell tool is always registered, so it can be invoked through the unauthenticated endpoint. In the shipped Docker image, commands execute as root.

What does an attacker need to exploit this issue?

An attacker needs only network access to the POST /tools/call endpoint and can send a single request that names the shell tool. This allows arbitrary operating-system commands to run as the server user.

How can I reduce exposure if I cannot patch immediately?

Restrict network access to the /tools/call endpoint so untrusted remote users cannot reach it. This is particularly urgent for deployments using the shipped Docker image because command execution occurs as root.

CVE-2026-75128: Langchain-Chatchat through 0.3.1.3 Unauthenticated RCE via /tools/call Endpoint

Affected Software

Event History

Frequently Asked Questions

Who is exposed to exploitation?

Is the default deployment affected?

What does an attacker need to exploit this issue?

How can I reduce exposure if I cannot patch immediately?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to exploitation?

Is the default deployment affected?

What does an attacker need to exploit this issue?

How can I reduce exposure if I cannot patch immediately?