CVE-2026-75128 is a critical (CVSS 9.8) missing-authentication flaw in Langchain-Chatchat through version 0.3.1.3: a remote attacker can execute arbitrary OS commands with one unauthenticated request.
What Is It
Langchain-Chatchat exposes a POST /tools/call API endpoint that runs any registered tool by name and does not require authentication. According to the NVD description, a shell tool is always registered, so anyone who can reach the endpoint can call it. The description says a remote attacker can send a single request that names the shell tool and run arbitrary OS commands as the server user. The advisory says that user is root in the shipped Docker image.
The weakness is classified as CWE-306 (Missing Authentication for Critical Function). VulnCheck assigned the CVE, and its NVD status is currently "Received."
Why It Matters
The CVSS scores rate this as easy to exploit and highly damaging:
- CVSS 3.1: 9.8 CRITICAL (
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) - CVSS 4.0: 9.3 CRITICAL
The attack works over the network, with low complexity and no privileges or user interaction. Confidentiality, integrity and availability impacts are all rated high. The advisory reports that commands run as root in the default Docker image, which would give an attacker full control of the container.
Exploitation status: No CISA KEV entry was provided for this CVE, so KEV does not currently confirm active exploitation. The CVSS 4.0 exploit maturity field is "Not Defined."
What's Vulnerable
- Vendor: chatchat-space
- Product: Langchain-Chatchat (
pkg:pypi/langchain-chatchat) - Affected versions: all versions through 0.3.1.3 (from 0 up to and including 0.3.1.3)
- Vulnerable code:
libs/chatchat-server/chatchat/server/api_server/tool_routes.py
Deployments using the shipped Docker image appear most at risk, because the advisory says the server runs as root there.
Patch Status
The supplied NVD record does not list a fixed version, and no CISA KEV required action or due date applies. Check the VulnCheck advisory and the project repository for remediation updates. Until a fix is confirmed, operators of affected versions should treat any network-reachable /tools/call endpoint as exposed to unauthenticated command execution.