Unauthenticated Remote Code Execution in Cognition by CognicellAI

CVE-2026-109437

What is CVE-2026-109437?

Cognition, a product by CognicellAI, is affected by a vulnerability that allows unauthenticated remote code execution. This issue is due to the agent sandbox backend defaulting to local execution combined with the absence of authentication on its REST/SSE API. Attackers can exploit this flaw by establishing a session through a POST request to /sessions and subsequently posting commands to the server via POST /sessions/{id}/messages without requiring credentials. As a result, the Deep Agents ReAct loop is susceptible to executing attacker-controlled shell commands through the local shell backend, posing a significant security risk.

References