Cognition CVE-2026-109437

Exploitation requires a pre-0.13.0 Cognition deployment running in its default configuration, where (1) the agent sandbox backend defaults to local execution and (2) the REST/SSE API ships with no authentication, allowing anonymous POST /sessions and POST /sessions/{id}/messages calls that drive the Deep Agents ReAct loop into shell execution. The primary limiting factor is deployment mode (the AT:P in the CVSS 4.0 vector): operators who placed the API behind an authenticating reverse proxy/network ACL, or who configured a non-local/sandboxed execution backend, are not exposed. No user interaction and no credentials are needed against affected default installations, so any network-reachable default instance is directly exploitable.

This is a genuine high-priority issue, not a CVSS-inflated paper risk. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) describes fully remote, low-complexity, unauthenticated exploitation with high confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H), and the description directly supports this: no authentication on the REST/SSE API plus a default-to-local shell backend yields remote code execution via two unauthenticated POST requests. The one tempering signal is AT:P (attack requirements present), which reflects that exploitation depends on the vulnerable default/deployment mode (local execution backend) rather than being unconditional - consistent with the CWE-1188 insecure-default root cause. A public exploit exists (referenced via Lasso/VulnCheck), which raises near-term risk, but this CVE is NOT in CISA KEV, so there is no confirmed active exploitation - POC availability and in-the-wild exploitation are distinct signals and should not be conflated. No EPSS score was provided, so exploitation-probability cannot be quantified from the input. Net: trivial-to-exploit unauthenticated RCE with public POC on an internet-reachable service warrants urgent patching wherever Cognition is exposed, tempered mainly by the product's limited deployment footprint rather than by any technical barrier.

An attacker who can reach a pre-0.13.0 Cognition instance's REST/SSE API sends an unauthenticated POST /sessions to create a session, then POST /sessions/{id}/messages with a crafted prompt that steers the Deep Agents ReAct loop into issuing shell commands through the default local backend. Because no credentials are required and complexity is low, the attacker gains code execution as the server process; a public exploit is already available, lowering the skill barrier.