Self-Hosted AI Agents: 6 CVEs at 9.8 in Letta, DB-GPT, Langchain-Chatchat, piflow and Cognition

On October 19 and 20, 2026, NVD published six CVEs rated 9.8 across five open source AI agent platforms you deploy yourself: Letta, DB-GPT (two CVEs), Langchain-Chatchat, piflow and Cognition. VulnCheck assigned all of them.

The story is the same every time, and it's worth pausing on: the agent can run code or shell commands, and its API asks for no authentication. No clever prompt injection required. You just ask nicely.

Every CVSS 3.1 score comes from VulnCheck (CNA), all with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. VulnCheck also publishes CVSS 4.0 scores: 9.3 across the board, except Cognition at 9.2 (AT:P). NVD hasn't analyzed any of them yet: Received for Letta, Langchain-Chatchat and piflow, Deferred for DB-GPT and Cognition. None is in CISA KEV at the time of writing.

Letta — CVE-2026-77936

The compose.yaml that ships with Letta doesn't enable LETTA_SERVER_SECURE. As a result, the password middleware is never registered and every API route is open. The same file also exposes a superuser PostgreSQL port with default credentials.

According to NVD, a remote attacker can then:

• run arbitrary Python through POST /v1/tools/run;
• manage users through /v1/admin;
• run OS commands through PostgreSQL's COPY PROGRAM.

That's two independent paths to code execution: one through the agent's API, the other through the database.

DB-GPT — CVE-2026-77932 and CVE-2026-77933

CVE-2026-77932: the /api/v1/chat/react-agent endpoint relies on a mock get_user_from_headers function that hands the admin role to every caller. An unauthenticated attacker can send prompts that make the ReAct agent's code_interpreter and shell_interpreter tools run Python or bash as root inside the container, with no sandbox.

CVE-2026-77933: the default docker-compose.yml sets a static MYSQL_ROOT_PASSWORD and publishes port 3306 on all interfaces. Anyone who reaches that port, or the shared dbgptnet Docker network, logs in as root@% with FILE and SUPER privileges.

They stack: NVD's description of the first one notes that the executed code can reach the bundled database using its default credentials.

Langchain-Chatchat — CVE-2026-75128

POST /tools/call invokes any registered tool by name, with no authentication. And a shell tool is always registered. A single request naming it runs OS commands as the server user — root in the shipped Docker image.

This is the bluntest one of the batch: there isn't even an LLM in the loop.

piflow — CVE-2026-109442

piflow's DeepAgents chat agent exposes POST /chat and POST /chat/stream without authentication. You can tell it to call the exec_shell tool, which hands the command to subprocess.run with no human approval and no allow-list. NVD highlights the exposure of environment secrets: LLM API keys and database credentials.

Cognition — CVE-2026-109437

Cognition defaults its agent sandbox to a local backend and ships its REST/SSE API with no authentication at all. POST /sessions opens a session, POST /sessions/{id}/messages posts into it, and the Deep Agents ReAct loop runs whatever shell commands the attacker dictates, with the server process's privileges.

It's the only project of the five where NVD's references point to a release: 0.13.0 (the description says "before 0.13.0").

The Common Thread

A few days ago we covered Archon and its AI agent API open to anyone. The pattern keeps coming back, and it comes from how these projects are built:

1. The shell tool isn't a bug, it's the feature. An agent that "can run code" is exactly what the user wants — on their laptop. Exposed on a network with no authentication, it's a remote shell.
2. The docker-compose file is what people actually run. In three of the five cases (Letta, DB-GPT, Langchain-Chatchat), the description blames the deployment file or the shipped image directly. Plenty of users run docker compose up as-is, then open the port to reach it from another machine.
3. The container runs as root (DB-GPT, Langchain-Chatchat). The container limits the blast radius somewhat, but it holds the API keys, the agent's data and often a path into the internal network.
4. The secrets are worth money. A stolen LLM API key gets resold, or simply burned on the victim's bill.

These are inferences from NVD's descriptions, not observed exploitation: no campaign is documented in the references so far.

Versions and Fixes

• Cognition: NVD references 0.13.0 as the first version out of range. Check the release notes to confirm it changes the default backend and adds authentication.
• Letta, DB-GPT, Langchain-Chatchat: NVD says "up to and including" (0.16.8, 0.8.2, 0.3.1.3) with no fixed version. See the VulnCheck advisories and GitHub repositories listed in the references.
• piflow: range 2.0.0 through 2.0.1, no fixed version given.

These bounds aren't necessarily the version to install: a newer release can keep the same default compose.yaml. Check the configuration, not just the version number.

Detection

• Network exposure: the application ports and the database ports (5432, 3306) reachable from outside the host (ss -tlnp, and docker ps for ports published on 0.0.0.0).
• Access logs: calls to /v1/tools/run, /v1/admin (Letta), /api/v1/chat/react-agent (DB-GPT), /tools/call (Langchain-Chatchat), /chat and /chat/stream (piflow), /sessions (Cognition) from unknown IPs.
• Processes: shells or interpreters spawned by the application process; COPY ... PROGRAM in PostgreSQL logs; root@% logins on MySQL.
• LLM billing: an unexplained spike in usage on the API key the agent uses.

Mitigation

1. Never expose these services directly: bind to 127.0.0.1 and put a VPN or an authenticating reverse proxy in front.
2. Letta: enable LETTA_SERVER_SECURE with a strong password, stop publishing the PostgreSQL port and change its credentials.
3. DB-GPT: change MYSQL_ROOT_PASSWORD, stop publishing port 3306, and cut network access to the ReAct agent until a fix ships.
4. Langchain-Chatchat, piflow: block /tools/call and the chat routes at the proxy, or disable the shell tools if the configuration allows it.
5. Cognition: move to 0.13.0 or later.
6. If an instance was exposed: treat it as compromised, rotate every LLM API key and credential in its environment, and rebuild the containers.

For more on this category, see the Langflow flaws from July.

Why Continuous Monitoring of Your Self-Hosted AI Tools Matters

These platforms install with a single command, often off the security team's radar, and ship new versions every week. Six critical CVEs in two days for a single category of tools: without an inventory, there's no way to know whether one is running somewhere in your environment.

With cveo.tech, add your self-hosted AI tools to your inventory and get an alert as soon as a critical CVE hits them.