Unauthenticated Remote Code Execution in Cognition

Cognition versions before 0.13.0 contain a critical unauthenticated remote code execution vulnerability identified as CVE-2026-109437. The flaw exists because the software defaults its agent sandbox backend to local execution and fails to enforce authentication on its REST/SSE API endpoints. An attacker can exploit this by interacting with the API to create sessions and send messages, which forces the Deep Agents ReAct loop to execute arbitrary commands. Because the system lacks authentication, these commands are executed with the privileges of the server process, leading to full system compromise. This vulnerability is particularly severe due to the ease of exploitation, requiring no prior access or credentials to the system.

Attack Chain

1. Attacker performs discovery to identify publicly exposed Cognition API instances.
2. Attacker initiates an unauthenticated session by sending a POST request to the /sessions endpoint.
3. API accepts the request and generates a session ID without requiring authentication tokens or credentials.
4. Attacker crafts a malicious message payload intended to trigger the Deep Agents ReAct loop.
5. Attacker sends the payload to the /sessions/{id}/messages endpoint via a POST request.
6. The backend processes the message and, due to the local execution sandbox configuration, interprets the embedded ReAct commands.
7. The server process executes the attacker-provided shell commands via the local shell backend.
8. Attacker achieves remote code execution as the user account running the Cognition server process.

Impact

Successful exploitation allows for arbitrary code execution on the server running the Cognition instance. This can lead to complete host takeover, lateral movement within the network, and exfiltration of sensitive data handled by the agent. The vulnerability affects all deployments of Cognition prior to version 0.13.0.

Recommendation

1. Upgrade Cognition to version 0.13.0 or later immediately to patch CVE-2026-109437.
2. Implement strict network access control lists (ACLs) to ensure the Cognition REST/SSE API is not accessible from the public internet.
3. Monitor web server logs for suspicious POST requests targeting /sessions and /sessions/{id}/messages endpoints from unauthorized IP addresses.