CVE-2026-109437: Initialization of a Resource with an Insecure Default in CognicellAI Cognition
Description
Cognition before 0.13.0 contains an unauthenticated remote code execution vulnerability due to defaulting its agent sandbox backend to local execution and shipping no authentication on its REST/SSE API. Attackers can create a session via POST /sessions and post a message via POST /sessions/{id}/messages without credentials, causing the Deep Agents ReAct loop to run attacker-directed shell commands through the local shell backend, resulting in remote code execution as the server process.
CVSS v4.0
Score 9.2critical
Affected software
CognicellAI
Cognition
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-109437 affects CognicellAI's Cognition product prior to version 0.13.0. The vulnerability arises because the agent sandbox backend defaults to local execution and the REST/SSE API lacks authentication. This allows unauthenticated attackers to create sessions via POST /sessions and send messages via POST /sessions/{id}/messages, triggering the Deep Agents ReAct loop to execute attacker-controlled shell commands on the server, resulting in remote code execution.
Potential Impact
Successful exploitation leads to remote code execution with the privileges of the server process, without requiring authentication. This poses a critical risk of full system compromise on affected installations.
Mitigation Recommendations
Upgrade to Cognition version 0.13.0 or later, where this vulnerability is fixed. No other mitigation or temporary workaround is indicated in the provided data.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-12T15:52:36.682Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad662ba2cdf04f6568033ff
Added to database: 10/19/2026, 18:34:34 UTC
Last enriched: 10/19/2026, 18:48:14 UTC
Last updated: 10/19/2026, 22:27:05 UTC
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.