CVE-2026-75128: unauthenticated shell tool RCE

CISO Take

Langchain-Chatchat through 0.3.1.3 exposes a POST /tools/call endpoint that runs any registered tool by name without authentication, and the always-registered shell tool lets a single request execute arbitrary OS commands, as root in the shipped Docker image. The CVSS is 9.8 with network reach, low complexity, and no privileges or user interaction needed. Exploitation likelihood is currently modest (EPSS 0.52%, around the 57th percentile), and there is no CISA KEV listing, public exploit, or Nuclei template. However, the flaw is trivial to weaponize from the description alone, and the public source reference makes it easy to reproduce. Any internet- or intranet-reachable Chatchat deployment should be treated as fully compromised-on-contact: restrict network access immediately, then check the vendor repository for a fixed release (none is cited in the available data, so verify before assuming one exists), and review hosts for unexpected commands and outbound connections.

Sources:NVDEPSSATLASlasso.securityvulncheck.comGitHub

What is the risk?

Critical. The flaw is a missing-authentication issue (CWE-306) that gives unauthenticated remote code execution with a single HTTP request. Exploitability is trivial and impact covers confidentiality, integrity, and availability. Short-term exploitation probability signals are low (EPSS 0.52%, no KEV, no public exploit, no scanner template), but these can change quickly once a PoC appears. Exposure depends on how many Chatchat servers are reachable beyond localhost. Because the Docker image runs as root, container compromise is immediate and a container escape or lateral movement could follow. Dependents and package risk data are unavailable, so blast radius is not quantified (Sin datos).

How does the attack unfold?

Initial Access

Attacker locates a reachable Langchain-Chatchat API server and requires no credentials to interact with it.

AML.T0049

Tool Invocation

A single POST to /tools/call names the always-registered shell tool with an attacker-chosen command.

AML.T0053

Execution

The server runs the command as the service user, which is root in the shipped Docker image.

AML.T0050

Impact

Attacker steals API keys and knowledge-base data, poisons the RAG store, and pivots into the internal network.

Initial Access

Attacker locates a reachable Langchain-Chatchat API server and requires no credentials to interact with it.

AML.T0049

Tool Invocation

A single POST to /tools/call names the always-registered shell tool with an attacker-chosen command.

AML.T0053

Execution

The server runs the command as the service user, which is root in the shipped Docker image.

AML.T0050

Impact

Attacker steals API keys and knowledge-base data, poisons the RAG store, and pivots into the internal network.

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

0.6%

chance of exploitation in 30 days

Higher than 50% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Do not expose the Chatchat API server to untrusted networks; bind to localhost or place it behind an authenticating reverse proxy or VPN. 2) Block or require authentication for POST /tools/call at the gateway or WAF as an immediate workaround. 3) Check the project's GitHub repository and the VulnCheck and Lasso advisories for a fixed version beyond 0.3.1.3, and upgrade when available; otherwise disable or remove the shell tool from the tool registry in a local patch. 4) Run the container as a non-root user with a read-only filesystem, dropped capabilities, and restricted egress. 5) Detect: search web and proxy logs for requests to /tools/call, especially naming the shell tool from unknown sources; monitor for unexpected child processes of the Chatchat server, new outbound connections, and new files or cron entries. 6) If exposure is suspected, rotate all secrets and API keys stored on the host and rebuild from a clean image.

What does CISA's SSVC say?

DecisionAttend

Exploitationpoc

AutomatableYes

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code ExecutionAuth BypassFrameworkAgentPluginAML.T0049- Exploit Public-Facing Application AML.T0050- Command and Scripting Interpreter AML.T0053- AI Agent Tool Invocation AML.T0084.001- Tool Definitions

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.4-AI system verification and validation

NIST AI RMF

MANAGE 2.3-Respond to previously unknown risksMEASURE 2.7-AI system security and resilience evaluated

OWASP LLM Top 10

LLM03-Supply ChainLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-75128?

Langchain-Chatchat through 0.3.1.3 exposes a POST /tools/call endpoint that runs any registered tool by name without authentication, and the always-registered shell tool lets a single request execute arbitrary OS commands, as root in the shipped Docker image. The CVSS is 9.8 with network reach, low complexity, and no privileges or user interaction needed. Exploitation likelihood is currently modest (EPSS 0.52%, around the 57th percentile), and there is no CISA KEV listing, public exploit, or Nuclei template. However, the flaw is trivial to weaponize from the description alone, and the public source reference makes it easy to reproduce. Any internet- or intranet-reachable Chatchat deployment should be treated as fully compromised-on-contact: restrict network access immediately, then check the vendor repository for a fixed release (none is cited in the available data, so verify before assuming one exists), and review hosts for unexpected commands and outbound connections.

Is CVE-2026-75128 actively exploited?

No confirmed active exploitation of CVE-2026-75128 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-75128?

1) Do not expose the Chatchat API server to untrusted networks; bind to localhost or place it behind an authenticating reverse proxy or VPN. 2) Block or require authentication for POST /tools/call at the gateway or WAF as an immediate workaround. 3) Check the project's GitHub repository and the VulnCheck and Lasso advisories for a fixed version beyond 0.3.1.3, and upgrade when available; otherwise disable or remove the shell tool from the tool registry in a local patch. 4) Run the container as a non-root user with a read-only filesystem, dropped capabilities, and restricted egress. 5) Detect: search web and proxy logs for requests to /tools/call, especially naming the shell tool from unknown sources; monitor for unexpected child processes of the Chatchat server, new outbound connections, and new files or cron entries. 6) If exposure is suspected, rotate all secrets and API keys stored on the host and rebuild from a clean image.

What systems are affected by CVE-2026-75128?

This vulnerability affects the following AI/ML architecture patterns: Agent frameworks, RAG pipelines, Self-hosted LLM application servers, Tool-calling / function-calling APIs, Containerized LLM deployments.

What is the CVSS score for CVE-2026-75128?

CVE-2026-75128 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 0.63%.

What is the AI security impact?

Affected AI Architectures

Agent frameworksRAG pipelinesSelf-hosted LLM application serversTool-calling / function-calling APIsContainerized LLM deployments

MITRE ATLAS Techniques

AML.T0049Exploit Public-Facing Application

AML.T0050Command and Scripting Interpreter

AML.T0053AI Agent Tool Invocation

AML.T0084.001Tool Definitions

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.4

NIST AI RMF: MANAGE 2.3, MEASURE 2.7

OWASP LLM Top 10: LLM03, LLM06

What are the technical details?

Original Advisory

Langchain-Chatchat through 0.3.1.3 exposes a POST /tools/call API endpoint that invokes any registered tool by name without authentication, leaving the always-registered shell tool callable. Remote attackers can send a single request naming the shell tool to execute arbitrary OS commands as the server user (root in the shipped Docker image).

Exploitation Scenario

An attacker scans for exposed Langchain-Chatchat instances on its default API port, or finds one on an internal network after initial foothold. They send a single POST request to /tools/call naming the shell tool with a command such as downloading and running a payload or opening a reverse shell. The command runs as root inside the container. The attacker then harvests LLM provider API keys, environment variables, and knowledge-base documents, modifies the vector store to poison RAG answers, and uses the host as a pivot or for cryptomining on GPU resources.

Weaknesses (CWE)

CWE-306Missing Authentication for Critical FunctionPrimary CWE-306Missing Authentication for Critical Function

CWE-306 — Missing Authentication for Critical Function: The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

[Architecture and Design] Divide the software into anonymous, normal, privileged, and administrative areas. Identify which of these areas require a proven user identity, and use a centralized authentication capability. Identify all potential communication channels, or other means of interaction with the software, to ensure that all channels are appropriately protected, including those channels that are assumed to be accessible only by authorized parties. Developers sometimes perform authentication at the primary channel, but open up a secondary channel that is assumed to be private. For example, a login mechanism may be listening on one network port, but after successful authentication, it may open up a second port where it waits for the connection, but avoids authentication because it assumes that only the authenticated party will connect to the port. In general, if the software or protocol allows a single session or user state to persist across multiple connections or channels, authentication and appropriate
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.