Cognition 0.13.0 Is the CVE Line. Compose Still Opts In.

US trends at 22:12 UTC were the NBA opener, Barca, and Vivek. Hacker News led with DeepInfer and Voxtral 3. VulnCheck published CVE-2026-109437 at 18:22:57 UTC on 19 October for CognicellAI Cognition.

Critical Critical because the record scores CVSS 4.0 9.2 and CVSS 3.1 9.8.

What VulnCheck published.#

The CNA is VulnCheck. The record is published. It was reserved at 15:52:36 UTC on 12 October. datePublic on the CNA container is 27 July, which is the date on the 0.13.0 changelog heading, not a separate July advisory. The vendor is CognicellAI. The product is Cognition. The package URL is pkg:github/CognicellAI/Cognition. The affected range is version 0 lessThan 0.13.0. The weaknesses are CWE-1188 and CWE-306.

The description says builds before 0.13.0 default the agent sandbox to local execution and ship no authentication on the REST and SSE API. A caller who can reach that API can open a session and send a message with no credential. The agent loop then runs shell commands through the local backend as the server process. This brief does not repeat the request paths.

Finder credit is Noy Pearl, Michael Sromin, and Ophir Dror. The references are Lasso's writeup, the v0.13.0 tag, and the VulnCheck advisory page. The repository advisory API returns an empty list. There is no GitHub advisory id to reconcile with the CVE id.

CVSS 4.0 is 9.2, CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N, with attack requirements present. CVSS 3.1 is 9.8, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Both labels are critical. They are different scoring systems. Keep both.

The repository description is "The foundational layer for trusted, executable AI platforms." The default branch is main. pushed_at is 13:13:03 UTC on 9 October, the same minute as the v0.16.3 release. Compare of v0.16.3 to main is identical.

The July tag and the October CVE.#

v0.13.0 published at 01:19:11 UTC on 28 July. The changelog heading is dated 27 July. From that GitHub timestamp to the CVE is 83 days, 17 hours, 3 minutes, and 46 seconds. From the 12 October reservation to the CVE is 7 days, 2 hours, and 30 minutes.

The security section on that release has four bullets. It hardens exact-scope checks on runtime storage. It restricts model-directed execution so production deployments do not silently fall back to host-local paths when sandbox execution is unavailable. It refuses builder-controlled callback URLs unless the HTTPS origin is operator-approved. It keeps trace redaction, trace retention, trace access control, MLflow experiment ownership, credentials, tenant authorization, and billing policy outside Cognition, under builder and operator control.

v0.16.3 published at 13:13:04 UTC on 9 October. The note says new runs pin the digest of the validated agent definition, and that older scoped records with sparse JSON no longer fail manifest checks. It says there is no new API or configuration requirement. It does not mention CVE-2026-109437.

CISA's ADP updated the record at 16:10:17 UTC on 20 October. The SSVC timestamp is 16:03:09 UTC the same day. Exploitation is poc. Automatable is no. Technical Impact is total. From the CVE publication to that SSVC timestamp is 21 hours and 40 minutes. poc is CISA's label for a public proof. It is not the value they use for active exploitation. The KEV catalog read tonight is version 2026.10.20, released at 19:00:31 UTC on 20 October, with 1,754 entries. It is later than the ADP timestamp, and this CVE is not in it.

What the tags actually set.#

server/app/settings.py on tag v0.12.0 sets sandbox_backend default local under COGNITION_SANDBOX_BACKEND. That file has no unsafe_local_execution field. The compose file on v0.12.0 sets the backend to local. Its comment says commands execute inside that container.

On v0.13.0 and on v0.16.3 the same backend field still defaults to local. unsafe_local_execution is present and defaults to false, aliased to COGNITION_ALLOW_UNSAFE_LOCAL_EXECUTION. The compose file on both of those tags sets the backend to local and sets the allow flag to true. The comment calls it an explicitly unsafe standalone development backend, and says commands execute inside that container, not in a production sandbox.

AGENTS.md on v0.13.0 and on v0.16.3 puts API authentication at a gateway or proxy, using OAuth, API keys, or mutual TLS. The same file says Cognition assumes authenticated callers, and that builders own authentication and authorization.

Lasso's remediation says to move to 0.13.0 or later, where the local shell is disabled unless explicitly enabled, to remove the allow flag outside isolated development because the compose quick start sets it, and to put an authenticating gateway in front because Cognition does not authenticate callers itself. Lasso's page badge says known exploit no. The same page contains a proof section. This brief did not run that proof and does not repeat it. CISA's label on the record is poc.

This brief read the release notes, the settings defaults, the compose files, and the trust doc. It did not start a server.

1. 2026-07-27
   Changelog heading date on 0.13.0. The CVE datePublic field is this day.
2. 2026-07-28
   GitHub release v0.13.0 at 01:19 UTC. Security notes restrict silent host-local fallback.
3. 2026-10-09
   v0.16.3 at 13:13 UTC. Main matches. The note does not name the CVE.
4. 2026-10-12
   CVE reserved at 15:52 UTC.
5. 2026-10-19
   CVE published at 18:22 UTC. CVSS 4.0 is 9.2. CVSS 3.1 is 9.8.
6. 2026-10-20
   CISA SSVC at 16:03 UTC: Exploitation poc, Automatable no. KEV 2026.10.20 at 19:00 UTC omits the id.

What to do.#

1. If the running build is before 0.13.0 and the API is reachable from a network you do not control, treat that host as the record describes. Move it to a release at or after 0.13.0. The newest tag tonight is v0.16.3.
2. Read the compose file you actually deployed. On the 0.13.0 and 0.16.3 tags, COGNITION_ALLOW_UNSAFE_LOCAL_EXECUTION is set true next to a local backend. That is the explicit development opt-in. Lasso says to remove it outside an isolated development box.
3. Put an authenticating gateway in front of the API. The trust doc on the fix tag says builders own authentication. The version number does not add that control.
4. Do not close the ticket on the 9 October note. v0.16.3 is past the CVE floor and does not mention the CVE.
5. CISA marks a public proof and marks the issue not automatable. The KEV file released tonight does not list the id. A missing KEV row is not a reason to leave the API open.
6. If a pre-0.13.0 process was reachable, rotate credentials that lived in that process. Lasso says the local backend passes the process environment through, including a GitHub token variable. This brief did not execute that path.