Cognition agent framework: Unauthenticated RCE flaw exposes host shell and credentials by default

Researchers disclosed a critical vulnerability (CVE-2026-74232, CVSS 9.8) in Cognition, an open-source self-hosted AI agent server built on LangChain’s Deep Agents framework (not to be confused with the commercial Cognition Labs). In its default configuration, the server exposes its REST API with no authentication and runs the agent on a local shell backend with an ungated command-execution tool, so an attacker who can reach the server can open a session, direct the agent to run a command, and have it executed on the host—including retrieving credentials such as a GitHub token the backend passes through. No authentication middleware was present in the affected router configuration, and no exploitation in the wild has been reported.