---
id: CVE-2026-109437
title: Cognition < 0.13.0 Unauthenticated RCE via Local Shell Backend
summary: >-
  Cognition before 0.13.0 contains an unauthenticated remote code execution
  vulnerability due to defaulting its agent sandbox backend to local execution
  and shipping no authentication on its REST/SSE API. Attackers can create a
  session via…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-1188
  - CWE-306
vendor: CognicellAI
product: Cognition
affected:
  - Cognition < 0.13.0
published: '2026-10-19'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T18:22:57.431Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-109437'
references:
  - url: 'https://www.lasso.security/vulnerability-database/cve-2026-109437'
    label: Lasso.security Advisory
  - url: 'https://github.com/CognicellAI/Cognition/releases/tag/v0.13.0'
    label: Fixed Release Tag
  - url: >-
      https://www.vulncheck.com/advisories/cognition-unauthenticated-rce-via-local-shell-backend
    label: >-
      VulnCheck Advisory: Cognition < 0.13.0 Unauthenticated RCE via Local Shell
      Backend
tags:
  - cve.org
ingestedAt: '2026-10-19T18:35:50.126Z'
---

## Overview

Cognition before 0.13.0 contains an unauthenticated remote code execution vulnerability due to defaulting its agent sandbox backend to local execution and shipping no authentication on its REST/SSE API. Attackers can create a session via POST /sessions and post a message via POST /sessions/{id}/messages without credentials, causing the Deep Agents ReAct loop to run attacker-directed shell commands through the local shell backend, resulting in remote code execution as the server process.

## Affected

- `Cognition < 0.13.0`

## Remediation

Upgrade to Cognition 0.13.0 or later. Version 0.13.0 refuses the local sandbox backend unless COGNITION_ALLOW_UNSAFE_LOCAL_EXECUTION is explicitly set to true, and that setting defaults to false.