Lasso Security wave: seventeen VulnCheck CVEs across twelve agent platforms, eleven RCE-class, three with a fix referenced (2026-10-15 to 10-20)

View raw markdownEdit on GitHub ↗

TL;DR

Between 2026-10-15 and 2026-10-20 VulnCheck published seventeen CVE records against twelve self-hosted agent platforms, every one referencing a Lasso Security vulnerability-database page and, where VulnCheck names reporters, credited to Noy Pearl, Michael Sromin and Ophir Dror. Eleven are RCE-class: four unauthenticated (DB-GPT CVE-2026-77932, Langchain-Chatchat CVE-2026-75128, piflow CVE-2026-109442, Cognition CVE-2026-109437), three reached by indirect prompt injection through content the agent reads (EvoScientist CVE-2026-77930, OpenSRE CVE-2026-109444, LangAlpha CVE-2026-109440), and four for any authenticated user (Aix-DB CVE-2026-77926, JoySafeter CVE-2026-109443, Coze Studio CVE-2026-77934, MoviePilot CVE-2026-77931). Only three records reference a fix (Cognition v0.13.0, EvoScientist v0.2.5, Coze Studio 0.5.0); for the other nine products the record's upper bound is the current release and no vendor advisory, security tab entry or maintainer reply was found. Four of the records name LangChain's Deep Agents framework, whose execute or shell tool the app runs with no approval gate, and a fifth (OpenSRE) matches the pattern; the framework's own two October advisories are in the Deep Agents file.

What happened

Lasso Security runs a public "vulnerability database" of findings against LLM apps, agents and MCP servers. On 2026-10-20 it listed 21 entries dated 2026-08-24 to 2026-10-18, each tagged "Agentic AI" with an attack-type label and a CVSS figure. VulnCheck, acting as CNA, published records for seventeen of them between 2026-10-15 and 2026-10-20, and every record's first reference is the Lasso page. The two VulnCheck pages opened this run (DB-GPT, Letta) credit Noy Pearl, Michael Sromin and Ophir Dror; the Lasso pages name no reporter. IntentKit's CVE-2026-76066 (2026-10-13), from the same reporters, is in its own file. The three remaining Lasso entries are not VulnCheck records: Astron Agent CVE-2026-108263 and MaxKB CVE-2026-77521 are GitHub-CNA vendor advisories already in this corpus, and the Yuxi id Lasso prints (CVE-2026-97693) does not exist on CVE Services as of 2026-10-20.

The records, from CVE Services (cveawg.mitre.org) on 2026-10-20, with the CNA's CVSS 4.0 and 3.1 scores:

CVE Product (vendor) Record title, shortened Affected 4.0 / 3.1 Fix referenced CNA date
CVE-2026-77932 DB-GPT (eosphoros-ai) unauthenticated RCE via /api/v1/chat/react-agent; a mock get_user_from_headers grants every caller admin through 0.8.2 9.3 / 9.8 none 10-20
CVE-2026-77933 DB-GPT hardcoded MySQL root credentials in the docker-compose.yml deployment through 0.8.2 9.3 / 9.8 none 10-20
CVE-2026-77936 Letta (letta-ai) insecure default configuration: unauthenticated API and PostgreSQL access through 0.16.8 9.3 / 9.8 none 10-20
CVE-2026-77937 Letta cross-tenant impersonation via a self-asserted user_id header, even with LETTA_SERVER_SECURE through 0.16.8 8.6 / 8.1 none 10-20
CVE-2026-77938 Letta credential exposure via tool-sandbox environment inheritance through 0.16.8 7.1 / 6.5 none 10-20
CVE-2026-75128 Langchain-Chatchat (chatchat-space) unauthenticated RCE via the /tools/call endpoint through 0.3.1.3 9.3 / 9.8 none 10-20
CVE-2026-109442 piflow (cas-bigdatalab) unauthenticated RCE: POST /chat and /chat/stream drive a DeepAgents chat agent whose exec_shell tool has no approval or allow-list 2.0.0 through 2.0.1 9.3 / 9.8 none 10-20
CVE-2026-109437 Cognition (CognicellAI) unauthenticated RCE: agent sandbox backend defaults to local execution and the REST/SSE API ships no authentication before 0.13.0 9.2 / 9.8 v0.13.0 release 10-19
CVE-2026-77930 EvoScientist human-approval bypass: async sub-agents lack the interrupt_on gate, so instructions in fetched web pages run host commands 0.1.0 before 0.2.5 8.7 / 8.8 v0.2.5 release, commit d249e32 10-20
CVE-2026-109444 OpenSRE (Tracer-Cloud) approval-gate bypass: the headless presenter's execution_allowed() always returns true, so injected alerts or Slack messages run shell_run through 0.1.2026.10.19 8.7 / 8.8 none 10-20
CVE-2026-109440 LangAlpha (ginlix-ai) indirect prompt injection to RCE: Bash and ExecuteCode have no allow-list or approval, vault secrets readable through 2026.09.07 8.6 / 8.1 none 10-20
CVE-2026-109441 LangAlpha cross-tenant sandbox exposure: all tenants' containers on Docker's default bridge with inter-container communication on through 2026.09.07 6.9 / 5.8 none 10-20
CVE-2026-77926 Aix-DB (apconw) authenticated non-admin RCE through the ChatBI common agent's ungated deepagents execute tool 1.2.4 8.7 / 8.8 none 10-20
CVE-2026-109443 JoySafeter (jd-opensource) authenticated RCE: self-registered users select "standard mode" and the Copilot's execute tool runs subprocess.run with shell=True through 1.0.0 8.7 / 8.8 none 10-20
CVE-2026-77934 Coze Studio (coze-dev) RCE via an unsandboxed local Python code runner before 0.5.0 8.7 / 8.8 commit fcf40d1 10-20
CVE-2026-77935 Coze Studio cross-space workflow IDOR in the workflow API handlers through 0.5.1 8.7 / 8.3 none 10-20
CVE-2026-77931 MoviePilot (jxxghp) command injection via ExecuteCommandTool 3.1.5 8.7 / 8.8 none 10-15

The shape is the one this corpus has filed since the Ro1ME wave and the VulnCheck single-researcher wave: a chat or alert endpoint, a model that can call a shell tool, and no gate between the two. What is new is the framework under it. The piflow, Cognition, Aix-DB and EvoScientist records name LangChain's Deep Agents (deepagents), and OpenSRE's "headless presenter" is the same pattern: the framework ships an execute tool and an interrupt mechanism, and the app either does not configure the interrupt or wires a presenter that approves everything. Deep Agents itself published two advisories in October for cases where its own rules can be bypassed; those are in the Deep Agents file.

Version and fix checks, 2026-10-20:

  • DB-GPT. PyPI dbgpt 0.8.2 (2026-08-26) is the newest release and the record's upper bound, so the current release is affected. The September Ro1ME file already carries DB-GPT's skill-upload CVE-2026-51866; these two are different endpoints.
  • Letta. The repository's newest tag is v0.16.8 (2026-05-14), which is the record's upper bound, so the current release is affected. PyPI letta is at 0.34.12 (2026-10-12) on a different version scheme that the records do not reference, so no "upgrade to" line can be derived from the registry. The repository's security tab is empty. The v0.16.8 release notes carry an unrelated pickle-to-JSON transport fix.
  • Cognition. The Lasso page says the local shell backend is disabled in v0.13.0 unless explicitly enabled. The v0.13.0 release notes (2026-07-27) say production settings "fail closed for unsupported host/local execution" and that model-directed execution no longer "silently fall[s] back to host-local paths"; the notes do not mention authentication on the REST/SSE API, so put the API behind an authenticating proxy regardless.
  • EvoScientist. The v0.2.5 release notes (2026-08-01) say human-in-the-loop approval now covers sync and async sub-agents under one policy and that async agents refuse pipe-into-interpreter commands. PyPI evoscientist is at 0.3.7.
  • Coze Studio. CVE-2026-77934's range ends before 0.5.0 and references a fix commit; CVE-2026-77935 reaches 0.5.1 with no fix. The repository's security tab is empty.
  • OpenSRE and LangAlpha. The records use date-shaped versions (0.1.2026.10.19, 2026.09.07) that read as the newest commit reviewed; PyPI opensre is at 2026.4.5 on a different scheme. Treat the current checkout as affected.
  • piflow, Langchain-Chatchat, Aix-DB, JoySafeter, MoviePilot. The record's upper bound is the newest version; nothing referenced says otherwise.

One identifier note. The Lasso page for Cognition lives at the URL slug cve-2026-74232 but prints CVE-2026-109437, and a search-engine snapshot of the index still showed Cognition as CVE-2026-74232. On CVE Services, CVE-2026-74232 is a VulnCheck record published 2026-08-27 for a Zbtlink router implant. The ids in the table above come from CVE Services, not from the slug.

Am I affected?

  • You self-host any product in the table at a version inside its range. For DB-GPT, Letta, Langchain-Chatchat, piflow, Aix-DB, JoySafeter, OpenSRE, LangAlpha and MoviePilot that is every version, including the newest.
  • The unauthenticated records (DB-GPT, Letta, Langchain-Chatchat, piflow, Cognition before 0.13.0) matter the moment the service is reachable from a network you do not control. Check what the host binds to and whether a reverse proxy adds authentication.
  • The prompt-injection records (EvoScientist, OpenSRE, LangAlpha) matter when the agent reads anything an outsider can write: web pages, alerts, Slack messages, tickets, documents.
  • You built your own app on Deep Agents with execute or a shell backend and did not set interrupt_on for it, or you wrote a presenter whose execution_allowed() returns true. The records describe exactly that app.
  • For Deep Agents, also read the framework's own October advisories: path rules and "Always allow" grants were bypassable in the framework before 0.7.25 and 0.0.13.

If you are affected

  1. Take the service off routable networks or put an authenticating reverse proxy in front of it today. None of the nine unfixed products has a vendor statement to wait for.
  2. Upgrade Cognition to v0.13.0 or later and keep the unsafe local-execution flag off, EvoScientist to v0.2.5 or later, and Coze Studio past the CVE-2026-77934 fix commit.
  3. Treat every credential in the service's environment as reachable by a prompt: LLM provider keys, database URLs, Slack and cloud tokens, the .vault_secrets style stores the records name. Rotate them if the service was reachable, following rotating cloud credentials.
  4. Where the framework supports it, put a human approval step on every tool that runs commands, writes files or moves money, and make the approval decision at the executor, not in the prompt.
  5. Run the agent process in a container or VM with no credentials it does not need, per agent sandboxing. The LangAlpha record is a reminder that tenants sharing one Docker bridge are not isolated from each other.
  6. If the host was reachable and ran one of the unauthenticated products, follow if your local AI agent was exploited.

Prevention

  • Agent sandboxing: an OS boundary under any agent that can run commands.
  • Credential hygiene: the environment the agent runs in is the credential set a prompt can reach.
  • MCP hygiene: the same gate question for tools reached over MCP.

Sources