Cognition API Lacks Auth, Enables Unauthenticated Remote Code Execution

Cognition software versions prior to 0.13.0 contain a critical security flaw that allows unauthenticated remote code execution. According to the National Vulnerability Database, the issue stems from missing authentication on REST and Server-Sent Events APIs, combined with a default local execution backend for agent sandboxes.

What happened

The vulnerability, tracked as CVE-2026-109437, permits attackers to create sessions and post messages without providing any credentials. The National Vulnerability Database records that an attacker can send a POST request to the /sessions endpoint to establish a session identifier. Subsequently, the attacker sends another POST request to the /sessions/{id}/messages endpoint using that specific identifier.

These actions trigger the Deep Agents ReAct loop within the application. Because the agent sandbox backend defaults to local execution, the system processes the attacker-directed input as shell commands. The National Vulnerability Database states that this results in remote code execution running with the privileges of the server process.

The flaw is classified with a CVSS score of 9.2, which is critical severity. The National Vulnerability Database associates the issue with CWE-1188, representing incorrect access control, and CWE-306, which denotes missing authentication for critical function. As Firewall Chronicle reported on 2026-10-13 regarding GPT-SoVITS UVR5, unauthenticated shell injection in AI tooling remains a persistent threat vector.

Why it matters

Environments running Cognition versions before 0.13.0 are exposed to direct server compromise. The absence of authentication means that any entity with network access to the API can initiate the attack chain. This mirrors the risk profile seen in other AI infrastructure flaws where default configurations prioritize functionality over security boundaries.

The impact is severe because the executed commands run as the server process. This grants the attacker the same level of access as the service itself. Defenders must assume that exposed instances are immediately vulnerable to remote code execution if no additional network-level restrictions are in place.

What to watch

• Verify the installed version of Cognition against the affected range.
• Review API gateway logs for unauthenticated POST requests to session endpoints.
• Monitor for unexpected shell command execution originating from the application process.
• Check if the agent sandbox backend has been explicitly configured away from local execution.

Signals worth monitoring

Teams usually detect this type of activity by reviewing web server access logs for unauthenticated POST requests to session creation endpoints. Security operations centers should check whether the application server is generating shell processes or executing commands that do not match normal operational patterns. Defenders typically look for outbound network connections from the server process that were not initiated by scheduled tasks. Incident responders often correlate these behavioral anomalies with sudden spikes in CPU or memory usage associated with the application service.

Background: CVSS score

CVSS provides a standardized vector for exploit difficulty and access requirements, not business value. A high score indicates an easy attack path, not necessarily significant damage. You must contextualize the score with your environment’s exposure, asset value, and compensating controls to determine true risk.

Read the full guide: CVSS Scores: Why High Numbers Mislead Your Risk Assessment

What to do and how to stay safe: Cognition

• Audit your Cognition deployment to confirm it is not running a version earlier than 0.13.0.
• Implement network-level access controls to restrict access to the REST and SSE API endpoints.
• Monitor server process activity for unexpected command execution or new child processes.
• Enable authentication mechanisms on the API if the vendor provides a secure configuration option.

General security guidance from the Firewall Chronicle newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of Cognition are affected by this vulnerability?

Versions of Cognition prior to 0.13.0 are affected by CVE-2026-109437.

How does an attacker exploit this flaw?

Attackers send unauthenticated POST requests to /sessions and /sessions/{id}/messages to execute shell commands.

What is the severity rating of this vulnerability?

The National Vulnerability Database rates CVE-2026-109437 as CVSS 9.2 Critical.