# Cognition 0.13.0 Is the CVE Line. Compose Still Opts In. > VulnCheck published CVE-2026-109437 at 18:22 UTC on 19 October for Cognition before 0.13.0. The sandbox defaults to local execution and the API has no authentication. Release 0.13.0 shipped at 01:19 UTC on 28 July and leaves authorization with the operator. On that tag and on 0.16.3 the backend default is still local, and compose sets the allow flag to true. Source: https://hackerlogs.com/blog/cognition-local-shell-cve-clock Published: 2026-10-20 ## Key takeaways - VulnCheck published CVE-2026-109437 at 18:22 UTC on 19 October. CVSS 4.0 is 9.2 and CVSS 3.1 is 9.8. The range is every build before 0.13.0. GitHub advisories for the repo are empty. - Release 0.13.0 published at 01:19 UTC on 28 July, 83 days and 17 hours before the CVE. The security notes restrict a silent host-local fallback. They do not say the API requires a login. - On 0.13.0 and on 0.16.3 the sandbox backend default is still local. A new allow flag defaults to false. The compose file on both tags sets that flag to true. - CISA ADP at 16:03 UTC on 20 October marks Exploitation as poc and Automatable as no. The KEV catalog released at 19:00 UTC the same day, 1,754 entries, does not list this CVE. US trends at 22:12 UTC were the NBA opener, Barca, and Vivek. Hacker News led with DeepInfer and Voxtral 3. VulnCheck published [CVE-2026-109437](https://www.cve.org/CVERecord?id=CVE-2026-109437) at 18:22:57 UTC on 19 October for CognicellAI Cognition. Critical because the record scores CVSS 4.0 9.2 and CVSS 3.1 9.8. Three panels for the Cognition sandbox clock: a local shell with no login, a July release named by an October CVE, and a compose file that still opts in. ## What VulnCheck published. The CNA is VulnCheck. The record is published. It was reserved at 15:52:36 UTC on 12 October. `datePublic` on the CNA container is 27 July, which is the date on the 0.13.0 changelog heading, not a separate July advisory. The vendor is CognicellAI. The product is Cognition. The package URL is `pkg:github/CognicellAI/Cognition`. The affected range is version `0` lessThan `0.13.0`. The weaknesses are CWE-1188 and CWE-306. The description says builds before 0.13.0 default the agent sandbox to local execution and ship no authentication on the REST and SSE API. A caller who can reach that API can open a session and send a message with no credential. The agent loop then runs shell commands through the local backend as the server process. This brief does not repeat the request paths. Finder credit is Noy Pearl, Michael Sromin, and Ophir Dror. The references are [Lasso's writeup](https://www.lasso.security/vulnerability-database/cve-2026-109437), the [v0.13.0 tag](https://github.com/CognicellAI/Cognition/releases/tag/v0.13.0), and the VulnCheck advisory page. The repository advisory API returns an empty list. There is no GitHub advisory id to reconcile with the CVE id. CVSS 4.0 is 9.2, `CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`, with attack requirements present. CVSS 3.1 is 9.8, `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`. Both labels are critical. They are different scoring systems. Keep both. The repository description is "The foundational layer for trusted, executable AI platforms." The default branch is `main`. `pushed_at` is 13:13:03 UTC on 9 October, the same minute as the v0.16.3 release. Compare of `v0.16.3` to `main` is identical. ## The July tag and the October CVE. [v0.13.0](https://github.com/CognicellAI/Cognition/releases/tag/v0.13.0) published at 01:19:11 UTC on 28 July. The changelog heading is dated 27 July. From that GitHub timestamp to the CVE is 83 days, 17 hours, 3 minutes, and 46 seconds. From the 12 October reservation to the CVE is 7 days, 2 hours, and 30 minutes. The security section on that release has four bullets. It hardens exact-scope checks on runtime storage. It restricts model-directed execution so production deployments do not silently fall back to host-local paths when sandbox execution is unavailable. It refuses builder-controlled callback URLs unless the HTTPS origin is operator-approved. It keeps trace redaction, trace retention, trace access control, MLflow experiment ownership, credentials, tenant authorization, and billing policy outside Cognition, under builder and operator control. [v0.16.3](https://github.com/CognicellAI/Cognition/releases/tag/v0.16.3) published at 13:13:04 UTC on 9 October. The note says new runs pin the digest of the validated agent definition, and that older scoped records with sparse JSON no longer fail manifest checks. It says there is no new API or configuration requirement. It does not mention CVE-2026-109437. CISA's ADP updated the record at 16:10:17 UTC on 20 October. The SSVC timestamp is 16:03:09 UTC the same day. Exploitation is `poc`. Automatable is no. Technical Impact is total. From the CVE publication to that SSVC timestamp is 21 hours and 40 minutes. `poc` is CISA's label for a public proof. It is not the value they use for active exploitation. The KEV catalog read tonight is version 2026.10.20, released at 19:00:31 UTC on 20 October, with 1,754 entries. It is later than the ADP timestamp, and this CVE is not in it. > The CVE line is every build before 0.13.0. The security notes on that tag restrict a silent host-local fallback in production. They leave tenant authorization with the operator. The sandbox backend default on 0.13.0 and on 0.16.3 is still `local`. A new allow flag defaults to false, and the compose file sets it to true. AGENTS.md on the fix tag still says the API assumes authenticated callers. ## What the tags actually set. `server/app/settings.py` on tag `v0.12.0` sets `sandbox_backend` default `local` under `COGNITION_SANDBOX_BACKEND`. That file has no `unsafe_local_execution` field. The compose file on `v0.12.0` sets the backend to `local`. Its comment says commands execute inside that container. On `v0.13.0` and on `v0.16.3` the same backend field still defaults to `local`. `unsafe_local_execution` is present and defaults to false, aliased to `COGNITION_ALLOW_UNSAFE_LOCAL_EXECUTION`. The compose file on both of those tags sets the backend to `local` and sets the allow flag to true. The comment calls it an explicitly unsafe standalone development backend, and says commands execute inside that container, not in a production sandbox. `AGENTS.md` on `v0.13.0` and on `v0.16.3` puts API authentication at a gateway or proxy, using OAuth, API keys, or mutual TLS. The same file says Cognition assumes authenticated callers, and that builders own authentication and authorization. Lasso's remediation says to move to 0.13.0 or later, where the local shell is disabled unless explicitly enabled, to remove the allow flag outside isolated development because the compose quick start sets it, and to put an authenticating gateway in front because Cognition does not authenticate callers itself. Lasso's page badge says known exploit no. The same page contains a proof section. This brief did not run that proof and does not repeat it. CISA's label on the record is `poc`. This brief read the release notes, the settings defaults, the compose files, and the trust doc. It did not start a server. ## What to do. 1. If the running build is before 0.13.0 and the API is reachable from a network you do not control, treat that host as the record describes. Move it to a release at or after 0.13.0. The newest tag tonight is v0.16.3. 2. Read the compose file you actually deployed. On the 0.13.0 and 0.16.3 tags, `COGNITION_ALLOW_UNSAFE_LOCAL_EXECUTION` is set true next to a local backend. That is the explicit development opt-in. Lasso says to remove it outside an isolated development box. 3. Put an authenticating gateway in front of the API. The trust doc on the fix tag says builders own authentication. The version number does not add that control. 4. Do not close the ticket on the 9 October note. v0.16.3 is past the CVE floor and does not mention the CVE. 5. CISA marks a public proof and marks the issue not automatable. The KEV file released tonight does not list the id. A missing KEV row is not a reason to leave the API open. 6. If a pre-0.13.0 process was reachable, rotate credentials that lived in that process. Lasso says the local backend passes the process environment through, including a GitHub token variable. This brief did not execute that path. ## Sources - [CVE-2026-109437](https://www.cve.org/CVERecord?id=CVE-2026-109437) (2026-10-19) - [Cognition v0.13.0](https://github.com/CognicellAI/Cognition/releases/tag/v0.13.0) (2026-07-28) - [Cognition v0.16.3](https://github.com/CognicellAI/Cognition/releases/tag/v0.16.3) (2026-10-09) - [CVE-2026-109437: Unauthenticated RCE via Local Shell Backend](https://www.lasso.security/vulnerability-database/cve-2026-109437) - [Known Exploited Vulnerabilities catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) (2026-10-20)