External risk intelligence

Cognition Unauthenticated Remote Code Execution via Local Shell Backend.

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-109437

The application exposes an unauthenticated REST/SSE API endpoint intended for session and message management. By design, this interface facilitates interaction with agent loops without requiring credentials, making it inherently public-facing in typical deployments where such services are exposed to enable remote API access.

Missing Authentication

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability exists in Cognition's agent sandbox that could allow unauthenticated attackers to execute arbitrary code on the server. This is due to the system defaulting to local execution and lacking authentication on its API, enabling attackers to create sessions and send messages without credentials, thereby running malicious shell commands.

Unauthenticated code execution via agent sandbox.
Leadership should remember this if using Cognition AI.
Confirm relevance and exposure for Cognition AI systems.

Attack Path

How an attacker could exploit the issue

An attacker can gain unauthorized access to a server running Cognition by exploiting a vulnerability in its API. This API, which lacks authentication by default, allows an attacker to create a session and send messages. These actions trigger the Deep Agents ReAct loop to execute arbitrary commands on the server, leading to remote code execution.

Unauthenticated API access required.
Attacker sends crafted session and message requests.
Leads to unauthenticated remote code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to execute arbitrary commands on the server. When the system defaults to using a local shell backend for its agent sandbox, an attacker can create sessions and send messages through the unauthenticated REST API to trigger command execution.

Server process and its data.
Unauthenticated API access.
Arbitrary command execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Cognition's agent sandbox backend requires immediate attention from the platform or application owner responsible for its deployment. The first practical step is to determine the scope of exposure: identify all instances of Cognition, confirm if the REST/SSE API is accessible externally, and ascertain business criticality before planning remediation.

Platform or application owner should triage.
Verify external API reachability and criticality.
Plan remediation based on exposure and risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Cognition?

Cognition is an AI-driven platform that utilizes Deep Agents—autonomous entities capable of executing tasks via a ReAct (Reasoning and Acting) loop. It incorporates an agent sandbox that typically interacts with system backends to perform work. Users deploy Cognition to automate complex workflows, relying on its ability to interpret instructions and run commands directly within the local server environment.

What does CVE-2026-109437 mean?

This CVE describes a failure to enforce authentication (CWE-306) and a risky default configuration (CWE-1188). Because the API lacks security controls, unauthorized users can interact with the system. The software defaults to using the local server's shell as the agent sandbox backend, allowing any API request to inadvertently trigger arbitrary commands as the server process.

How does an attacker trigger this vulnerability?

An attacker initiates the attack by sending unauthenticated POST requests to the session and messaging endpoints. By crafting these messages, they force the Deep Agents loop to interpret and execute shell commands. Simply pinging the API or viewing documentation does not trigger the bug; the system must process a specific, attacker-provided message request that activates the command execution path.

Do I need to worry if my Cognition instance is internal?

Yes, but your risk profile varies. Halo Surface Signal identifies that Cognition's API is designed for remote access, making it highly likely to be internet-facing in many standard deployments. If your instance is restricted to an internal network, you have reduced immediate exposure to external actors, but the lack of internal authentication still presents a significant risk from compromised accounts or malicious insiders.

What should I do first to address this?

Your first step is to inventory all running instances of Cognition within your environment. Once identified, verify whether the REST/SSE API endpoints are reachable from outside your trusted network. Assess the business importance of these systems to prioritize your response, then plan to update the software or restrict network access to the API while you coordinate a permanent fix with your platform team.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.