CVE-2026-109437 is a critical (CVSS 3.1 9.8) unauthenticated remote code execution flaw in CognicellAI's Cognition. Before version 0.13.0, the agent sandbox ran locally by default and the REST/SSE API had no authentication.
What Is It
The flaw comes from two unsafe defaults that combine to allow code execution. Cognition versions before 0.13.0 run the agent sandbox backend as local execution by default, and the REST/SSE API ships with no authentication.
An attacker needs no credentials. They create a session with POST /sessions, then send a message with POST /sessions/{id}/messages. That makes the Deep Agents ReAct loop run shell commands the attacker chose through the local shell backend. The commands execute as the server process.
The vulnerability is classified under two weaknesses: - CWE-306: Missing Authentication for Critical Function - CWE-1188: Initialization of a Resource with an Insecure Default
Why It Matters
- CVSS 3.1: 9.8 CRITICAL (
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) - CVSS 4.0: 9.2 CRITICAL (VulnCheck, secondary). This vector marks Attack Requirements as Present.
The attack works over the network, needs no privileges and no user interaction, and has low complexity. A successful attack gives the attacker code execution with the privileges of the Cognition server process, with high impact to confidentiality, integrity and availability.
This CVE is not in the supplied CISA KEV data. Active exploitation is therefore not confirmed by KEV at this time. The CVSS 4.0 exploit maturity field is also "Not Defined."
NVD lists the record status as "Deferred." VulnCheck disclosed the issue, and the record was published on 2026-10-19.
What's Vulnerable
| Vendor | Product | Affected Versions |
|---|---|---|
| CognicellAI | Cognition | 0 through versions earlier than 0.13.0 (semver) |
- Package:
pkg:github/CognicellAI/Cognition - Repository: https://github.com/CognicellAI/Cognition
NVD does not list any affected CPEs.
Patch Status
The affected range ends below version 0.13.0, and the references include the v0.13.0 release tag. Cognition operators should upgrade to version 0.13.0 or later.
There is no CISA KEV entry, so no federal required action or due date applies. Until an instance is upgraded, keep in mind that the vulnerable defaults leave the /sessions API endpoints reachable without credentials.