TI-2026-76552 CVE-2026-109437 · GHSA-c2qr-crjw-844g
Unauthenticated code execution in Cognition via local shell backend
Priority HIGH 75
Cognition before 0.13.0 contains an unauthenticated remote code execution vulnerability due to defaulting its agent sandbox backend to local execution and shipping no authentication on its REST/SSE API.