---
id: CVE-2026-75128
title: >-
  Langchain-Chatchat through 0.3.1.3 Unauthenticated RCE via /tools/call
  Endpoint
summary: >-
  Langchain-Chatchat through 0.3.1.3 exposes a POST /tools/call API endpoint
  that invokes any registered tool by name without authentication, leaving the
  always-registered shell tool callable. Remote attackers can send a single
  request nam…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-306
vendor: chatchat-space
product: Langchain-Chatchat
affected:
  - Langchain-Chatchat <= 0.3.1.3
published: '2026-10-20'
updated: '2026-10-20'
sourceUpdated: '2026-10-20T00:46:08.977Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-75128'
references:
  - url: 'https://www.lasso.security/vulnerability-database/cve-2026-75128'
    label: Lasso.security Advisory
  - url: >-
      https://github.com/chatchat-space/Langchain-Chatchat/blob/a6a9193b5002061719f0eee62c6310bd5b1b7f63/libs/chatchat-server/chatchat/server/api_server/tool_routes.py#L33
  - url: >-
      https://www.vulncheck.com/advisories/langchain-chatchat-through-0.3.1.3-unauthenticated-rce-via-tools-call-endpoint
    label: >-
      VulnCheck Advisory: Langchain-Chatchat through 0.3.1.3 Unauthenticated RCE
      via /tools/call Endpoint
tags:
  - cve.org
ingestedAt: '2026-10-20T01:49:42.627Z'
---

## Overview

Langchain-Chatchat through 0.3.1.3 exposes a POST /tools/call API endpoint that invokes any registered tool by name without authentication, leaving the always-registered shell tool callable. Remote attackers can send a single request naming the shell tool to execute arbitrary OS commands as the server user (root in the shipped Docker image).

## Affected

- `Langchain-Chatchat <= 0.3.1.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.