Skip to content
Critical RCE Vulnerability Found in Cognition Versions Prior to 0.13.0

Critical RCE Vulnerability Found in Cognition Versions Prior to 0.13.0

First seen 23 Oct 2026, 20:43 UTC • • •Early signal · one source
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 23, 2026 at 22:13 UTC
  • •Cognition versions before 0.13.0 are vulnerable to unauthenticated RCE.
  • •Attackers can exploit the flaw to execute arbitrary shell commands.
  • •The vulnerability has a CVSS score of 9.8, classified as critical.

Cognition versions before 0.13.0 have been found to contain an unauthenticated remote code execution (RCE) vulnerability. This flaw arises from the default configuration of its agent sandbox backend, which allows attackers to create sessions and execute shell commands without authentication. The vulnerability has a CVSS 3.1 score of 9.8, indicating a critical severity level. Organizations using affected versions are at risk of unauthorized access and potential system compromise. The vulnerability is documented as CVE-2026-109437. Active threat intelligence is recommended for prioritizing remediation efforts. No patch has been reported yet for this issue.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-20
CVE-2026-109437 disclosed
Cognition versions before 0.13.0 found to have a critical RCE vulnerability due to improper authentication.
Rapid7

More articles in this cluster (1)

Extracted Entities (2)

1 / 3

Common questions

Which versions are affected?
Cognition versions prior to 0.13.0 are affected by this vulnerability.
Is there a patch available?
No patch has been reported for this vulnerability as of now.
What should organizations do?
Organizations should monitor for updates and apply threat intelligence to prioritize remediation.