External risk intelligence

Langchain-Chatchat Unauthenticated Remote Code Execution via Tool Call API.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-75128

The vulnerability exists in a web API endpoint (/tools/call) within a server-side application. As a backend component designed to process API requests, such services are commonly deployed as network-accessible interfaces for web applications, making them a likely target for external interaction in typical deployment patterns.

Missing Authentication

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in Langchain-Chatchat that allows unauthenticated attackers to execute arbitrary operating system commands. The issue stems from an API endpoint that directly invokes tools without proper authentication, including a powerful shell tool. This could enable attackers to compromise the server.

Unauthenticated API calls allow command execution.
Server compromise is possible if the tool is exposed.
Confirm if this tool is deployed and exposed.

Attack Path

How an attacker could exploit the issue

An attacker can reach the vulnerable component by sending a crafted request to a publicly exposed API endpoint. This endpoint, designed to invoke specific tools, lacks proper authentication, allowing any remote user to specify and execute a tool. The always-available "shell" tool can then be invoked to run arbitrary operating system commands.

No authentication required.
POST to `/tools/call` triggers vulnerability.
Arbitrary OS command execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated remote attacker to execute arbitrary operating system commands on the server. This is possible when the POST /tools/call API endpoint is accessible and the "shell" tool is registered and invoked without proper authentication. The consequence is that an attacker could potentially gain full control of the server.

Arbitrary OS command execution.
Invoking the "shell" tool via API.
Full server compromise is possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Langchain-Chatchat application's unauthenticated remote code execution vulnerability requires immediate attention from teams managing web services and backend infrastructure. The first practical step is to locate all instances of this application, confirm its accessibility from external networks, and assess its business criticality. Once these are understood, the responsible team or owner must be identified to plan and execute remediation, considering potential temporary risk reductions if immediate patching is not feasible.

Assign ownership to the service owner.
Verify external reachability and asset criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Langchain-Chatchat?

Langchain-Chatchat is a software framework that combines LangChain with local LLMs to provide a chat interface for document processing and knowledge management. It often runs as a server-side backend application, managing various automated tools that perform tasks like searching, data retrieval, or system interaction on behalf of the user.

What does CVE-2026-75128 mean for security?

This vulnerability is classified as CWE-306, which refers to Missing Authentication for Critical Function. In this case, the application's API allows anyone to invoke backend tools without verifying their identity. Because a shell tool is registered by default, this flaw enables unauthorized users to trigger commands that run directly on the host operating system.

How is this vulnerability triggered?

The issue is triggered by sending a specially crafted POST request to the /tools/call API endpoint. The vulnerability is specifically tied to the ability to name and execute the shell tool remotely. Requests that do not target the tool execution functionality, or deployments where the shell tool has been explicitly disabled or removed from the registry, do not encounter this specific command execution path.

Do I need to worry if my instance is not on the internet?

Halo Surface Signal indicates that because this vulnerability exists in a web API endpoint, services deployed as network-accessible interfaces are primary targets. If your instance is restricted to an internal network, the likelihood of external interaction is reduced, but the risk remains if an attacker gains access to your internal environment. You should assess whether your architecture permits reachability to this specific API.

What are the first steps to address this issue?

Begin by identifying all running instances of Langchain-Chatchat within your environment to determine which are reachable over a network. Once identified, work with the service owners to evaluate the application's configuration. Prioritize restricting access to the /tools/call endpoint and investigate whether the shell tool can be disabled or if an update is available to enforce authentication for all tool calls.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.