Secure Cognition API Endpoints Before Attackers Execute Remote Code

Remote attackers can execute arbitrary code on servers running vulnerable versions of Cognition software without providing any credentials. The flaw enables adversaries to run shell commands directly on the host system, granting them control equal to the server process itself. This capability exists because the application defaults to a local execution backend for its agent sandbox while exposing its API without authentication.

The vulnerability affects Cognition releases prior to version 0.13.0. According to the National Vulnerability Database, the issue is rated as critical with a CVSS score of 9.2. The weakness stems from the combination of missing authentication controls and a default configuration that permits local shell execution. Attackers exploit this by interacting with specific API endpoints that trigger the application’s internal processing loops.

Technical Mechanics

The attack requires an adversary to create a session and then post a message to that session. The application processes these inputs through its Deep Agents ReAct loop. Because the agent sandbox backend defaults to local execution, the loop runs attacker-directed shell commands on the host machine. This results in full remote code execution capabilities for anyone who can reach the API endpoints.

Affected Software

Only Cognition versions earlier than 0.13.0 are impacted by this specific vulnerability. Organizations using older builds must verify their current version numbers immediately. The flaw is inherent in how these earlier versions ship their REST and SSE API components. No authentication is included in the default configuration of these affected releases.

What to watch

Monitor network traffic for unauthorized POST requests to session endpoints. Look for unusual shell activity originating from the application process. Check server logs for command executions that do not match expected application behavior. Keep an eye on vendor announcements for patches or mitigation guidance for versions before 0.13.0.

What made it possible

This incident highlights the risks of exposing agent-based systems without robust identity verification. When applications default to local execution environments, they often assume a trusted perimeter. However, missing authentication on public-facing APIs removes that protection. Attackers simply need network access to trigger internal logic. Teams usually mitigate this by enforcing strict access controls on all API endpoints. Check whether your deployment requires credentials for every interaction. Ensure that sandboxed processes cannot execute host-level commands unless explicitly authorized. Verify that default configurations prioritize security over convenience.

What to do and how to stay safe

• Update Cognition software to version 0.13.0 or later as soon as possible.
• Implement authentication mechanisms on all REST and SSE API endpoints immediately.
• Restrict network access to the application servers to trusted IP addresses only.
• Monitor server processes for unexpected shell command executions or new sessions.

Step-by-step guide: How Security Advisories Drive Patch Decisions and Reduce Risk

General security guidance from the Shell Bulletin newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of Cognition are vulnerable to this remote code execution flaw?

All versions of Cognition prior to 0.13.0