How Does CVE-2026-109437 Enable Unauthenticated Code Execution in Cognition < 0.13.0?

The short version

• Cognition before version 0.13.0 suffers from an unauthenticated remote code execution flaw.
• The issue stems from a local execution sandbox backend and a lack of API authentication.
• Exploitation involves creating sessions and posting messages without any credentials.

The details

Cognition versions prior to 0.13.0 contain a critical vulnerability that allows remote code execution without authentication, according to the National Vulnerability Database record for CVE-2026-109437. The flaw arises because the software defaults its agent sandbox backend to local execution while shipping no authentication on its REST and Server-Sent Events API. This configuration leaves the system open to unauthorised access from any remote attacker who can reach the service.

An attacker can create a session by sending a POST request to the /sessions endpoint. They can then post a message to the /sessions/{id}/messages endpoint without providing any credentials. These actions trigger the Deep Agents ReAct loop to run attacker-directed shell commands through the local shell backend. This results in remote code execution running with the privileges of the server process.

The context

The National Vulnerability Database lists two weaknesses associated with this issue: CWE-1188 and CWE-306. These categories relate to insufficient access control and missing authentication mechanisms. The affected product is identified as CognicellAI Cognition. The vulnerability applies to all versions before 0.13.0. No specific date of disclosure or patch release is mentioned in the provided source material.

Next steps

Organisations should verify which versions of Cognition are deployed in their environments. Teams must check if any instances are running versions prior to 0.13.0. If vulnerable versions are found, they should be isolated from untrusted networks immediately. Monitoring for unusual outbound connections or process spawns is recommended until a fix is available.

What defenders should look for

Security operations teams should monitor web application logs for unauthorised POST requests to session management endpoints. Look for sequences where session creation is immediately followed by message posting without prior authentication handshakes. Alert on any shell command execution originating from the application server process that does not match normal operational patterns.

Check for new processes spawned by the web service that differ from expected background tasks. Investigate any outbound network connections initiated by the application server that were not present during baseline operations. Review firewall logs for unexpected traffic from the server to external command and control infrastructure.

What to do and how to stay safe: Cognition

• Audit your infrastructure to identify any installations of Cognition versions earlier than 0.13.0.
• Restrict network access to the application's API endpoints to trusted internal IP ranges only.
• Monitor server processes for unexpected command execution or new child processes spawned by the web service.
• Prepare to upgrade to version 0.13.0 or later once the vendor provides a confirmed update.

Step-by-step guide: How Virtual Patching Works: The Mechanics Behind Inline Protection

General security guidance from the Honeypot Daily newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-109437?

The National Vulnerability Database rates CVE-2026-109437 as critical with a CVSS score of 9.2.

Which versions of Cognition are affected by this vulnerability?

All versions of Cognition before 0.13.0 are affected by this unauthenticated remote code execution flaw.

How do attackers exploit this vulnerability?

Attackers exploit it by sending POST requests to /sessions and /sessions/{id}/messages without credentials.