CVE-2026-109437: CognicellAI Cognition

The National Vulnerability Database (NVD) record says CognicellAI's Cognition before 0.13.0 defaults its agent sandbox backend to local execution and has no authentication on its REST/SSE (Representational State Transfer and server-sent events) API, so anyone can create a session and post a message that makes the Deep Agents ReAct loop run attacker-directed shell commands as the server process.

The record

Kind

Vulnerability

Source record

CVE-2026-109437: Cognition before 0.13.0 contains an unauthenticated remote code execution vulnerability due to defaulting its (National Vulnerability Database record)

Record published

2026-10-19

Posted here

2026-10-29

World

Software agents · Enterprise work agents

Controls concerned

Authority binding C-A2; Containment and isolation C-E5

Checked

Checked against its record on 2026-10-29 by a reader who did not draft it; report verification/reports/SIG-2026-10-29-001-2026-10-29.md.

A signal's controls are the ones its record points at, the exposure; a case's controls are the ones its records show were absent or failed, so the two can differ.

Corrections

Changes to what this signal says, with the reason. Every earlier version is kept.

• 2026-10-29: Summary. Independent read on 29 October 2026: the record names the vendor CognicellAI (product Cognition); REST was not spelled out at first use.
  Show the change

  Before: The National Vulnerability Database (NVD) record says Cognition before 0.13.0 defaults its agent sandbox backend to local execution and has no authentication on its REST/SSE (server-sent events) API, so anyone can create a session and post a message that makes the Deep Agents ReAct loop run attacker-directed shell commands as the server process.

  After: The National Vulnerability Database (NVD) record says CognicellAI's Cognition before 0.13.0 defaults its agent sandbox backend to local execution and has no authentication on its REST/SSE (Representational State Transfer and server-sent events) API, so anyone can create a session and post a message that makes the Deep Agents ReAct loop run attacker-directed shell commands as the server process.
• 2026-10-29: Title. Independent read on 29 October 2026 (CVE record copy at app.opencve.io): the record names the vendor as CognicellAI; 'Cognition' alone could be read as a different company of that name.
  Show the change

  Before: CVE-2026-109437: Cognition

  After: CVE-2026-109437: CognicellAI Cognition

What a signal is. A signal records what a primary record says; it assigns no fault. It is lighter than a case: one dated item from one record, tagged with the world, sector and controls it touches. It becomes a case when it meets the bar for one.

Newer: Wiz incident response report: an unnamed artificial intelligence (AI) agent system ran a multi-cloud intrusion
Older: CVE-2026-112308: crewai-tools