Summary
Cognition deployments before 0.13.0 may expose REST and SSE session-management endpoints without authentication while using local execution as the default agent sandbox backend. An unauthenticated remote attacker could direct an agent session to run shell commands, potentially achieving remote code execution with the privileges of the server process.
Cognition deployments before 0.13.0 may expose REST and SSE session-management endpoints without authentication while using local execution as the default agent sandbox backend. An unauthenticated remote attacker could direct an agent session to run shell commands, potentially achieving remote code execution with the privileges of the server process.
Affected context
The vulnerability affects Cognition deployments where the REST/SSE API is reachable by an attacker, authentication is not enforced, and the agent sandbox defaults to local shell execution. The risk is greatest when the service is network-accessible and the server process has broad filesystem, credential, or infrastructure permissions.
The vulnerability affects Cognition deployments where the REST/SSE API is reachable by an attacker, authentication is not enforced, and the agent sandbox defaults to local shell execution. The risk is greatest when the service is network-accessible and the server process has broad filesystem, credential, or infrastructure permissions.
Exploit preconditions
- Attack surface: Cognition REST/SSE session API
- Required access: Network connectivity to the exposed API; no valid credentials are required when authentication is absent
- Trigger point: Creation of an agent session followed by attacker-controlled session messaging
- Why exploitation is possible: The API accepts unauthenticated requests, and the agent execution loop can route attacker-directed actions to a local shell backend
- Attack surface: Cognition REST/SSE session API
- Required access: Network connectivity to the exposed API; no valid credentials are required when authentication is absent
- Trigger point: Creation of an agent session followed by attacker-controlled session messaging
- Why exploitation is possible: The API accepts unauthenticated requests, and the agent execution loop can route attacker-directed actions to a local shell backend
Why this happens
The primary flaw is a missing authentication control around critical session-management functions, mapping to CWE-306: Missing Authentication for Critical Function. The security boundary is further weakened by an insecure default, represented by CWE-1188: Insecure Default Initialization of Resource, because agent operations use local execution unless a safer sandbox is explicitly configured. Together, unauthenticated access and a privileged execution backend allow external input to reach operating-system command execution.
The primary flaw is a missing authentication control around critical session-management functions, mapping to CWE-306: Missing Authentication for Critical Function. The security boundary is further weakened by an insecure default, represented by CWE-1188: Insecure Default Initialization of Resource, because agent operations use local execution unless a safer sandbox is explicitly configured. Together, unauthenticated access and a privileged execution backend allow external input to reach operating-system command execution.
Potential impact
- An attacker may execute arbitrary commands as the server process.
- The service could be used to access, alter, or delete local files.
- Credentials, tokens, or other secrets available to the process could be exposed.
- The host or connected services could be compromised through lateral movement.
- Agent data and downstream workflows could be manipulated or disrupted.
- An attacker may execute arbitrary commands as the server process.
- The service could be used to access, alter, or delete local files.
- Credentials, tokens, or other secrets available to the process could be exposed.
- The host or connected services could be compromised through lateral movement.
- Agent data and downstream workflows could be manipulated or disrupted.
General mitigation guidance
Mitigation generally focuses on enforcing authentication and authorization for every session-management operation, including streaming endpoints.
Common defensive patterns include:
- Require strong authentication before session creation or message submission.
- Apply resource-level authorization so users can access only permitted sessions.
- Use a non-executing or isolated sandbox as the secure default rather than local shell execution.
- Restrict agent tool capabilities and apply explicit command and filesystem policies.
- Run the service with least-privilege identities, minimal network access, and isolated runtime permissions.
- Keep administrative and internal APIs off publicly reachable interfaces.
- Treat all agent instructions and session content as untrusted input.
Mitigation generally focuses on enforcing authentication and authorization for every session-management operation, including streaming endpoints.
Common defensive patterns include:
- Require strong authentication before session creation or message submission.
- Apply resource-level authorization so users can access only permitted sessions.
- Use a non-executing or isolated sandbox as the secure default rather than local shell execution.
- Restrict agent tool capabilities and apply explicit command and filesystem policies.
- Run the service with least-privilege identities, minimal network access, and isolated runtime permissions.
- Keep administrative and internal APIs off publicly reachable interfaces.
- Treat all agent instructions and session content as untrusted input.
How teams detect issues like this
Organizations can identify similar risks through:
- Static analysis and configuration checks for APIs that expose session creation without authentication middleware.
- Code review signals showing shell or subprocess backends selected by default.
- Tests that verify unauthenticated requests are rejected across REST and SSE routes.
- API gateway and policy enforcement requiring authentication, authorization, and rate limits.
- Runtime monitoring for unusual session creation, command execution, process spawning, or access to sensitive files.
- Automated security review tools that flag missing access controls and dangerous execution defaults.
Organizations can identify similar risks through:
- Static analysis and configuration checks for APIs that expose session creation without authentication middleware.
- Code review signals showing shell or subprocess backends selected by default.
- Tests that verify unauthenticated requests are rejected across REST and SSE routes.
- API gateway and policy enforcement requiring authentication, authorization, and rate limits.
- Runtime monitoring for unusual session creation, command execution, process spawning, or access to sensitive files.
- Automated security review tools that flag missing access controls and dangerous execution defaults.
Sources
| Source | Link |
|---|---|
| github. | github.com/ |
| lasso. | lasso.security/ |
| vulncheck. | vulncheck.com/ |
