Key points
- CVE-2026-75128 carries a CVSS score of 9.3, rated critical by the National Vulnerability Database.
- The vulnerability affects Langchain-Chatchat versions through 0.3.1.3, including the chatchat-space variant.
- Attackers can execute arbitrary operating system commands as the server user, which is root in Docker images.
Langchain-Chatchat versions up to 0.3.1.3 contain a critical security flaw that permits unauthenticated remote code execution. The National Vulnerability Database has assigned CVE-2026-75128 to this issue, rating it with a CVSS score of 9.3.
What happened
The vulnerability exists within a POST /tools/call API endpoint that invokes registered tools by name. This endpoint operates without any form of authentication, as noted in the NVD record. Because a shell tool is always registered by default in these versions, it remains callable by anyone who can reach the service.
Remote attackers can exploit this by sending a single request that names the shell tool. This action allows them to execute arbitrary operating system commands on the host machine. The commands run with the privileges of the server user, which is often root in the shipped Docker image.
Why it matters
The absence of authentication on the API endpoint means that no credentials are required to trigger the flaw. This significantly lowers the barrier for exploitation, allowing unauthenticated remote attackers to gain immediate control. The use of CWE-306, improper authentication, highlights the fundamental failure in access control mechanisms.
Running as root in the provided Docker image amplifies the potential impact of successful exploitation. Attackers gain full control over the container and potentially the host system if privileges are not strictly isolated. This creates a severe risk for organisations deploying these versions in exposed environments.
What happens next
- Verify if any internal deployments are running Langchain-Chatchat versions 0.3.1.3 or earlier.
- Check network logs for any unauthorised POST requests to the /tools/call endpoint.
- Isolate affected systems from untrusted networks until a mitigation strategy is confirmed.
- Monitor vendor communications for an official patch or version update addressing CVE-2026-75128.
Patch priority
Teams should immediately identify all instances of Langchain-Chatchat in their environment, focusing on those exposed to untrusted networks. Prioritise systems running the vulnerable versions for immediate isolation or decommissioning. Conduct a thorough review of access controls for any API endpoints that invoke external tools. Ensure that testing environments are updated first to validate any future patches. Back up configuration files before making changes to prevent data loss during remediation efforts.
Background: Remote code execution vulnerabilities
Remote code execution often occurs because developers trust user input without validation, fail to restrict file permissions, or neglect to update dependencies. Fix these errors by enforcing strict input sanitisation, applying least-privilege principles, and integrating automated security checks into your secure software development lifecycle to prevent arbitrary command execution.
Read the full guide: Seven Configuration Mistakes That Allow Remote Code Execution
What to do and how to stay safe: Langchain-Chatchat
- Restrict network access to the API endpoint using firewall rules to block unauthorised external traffic.
- Implement strict authentication mechanisms for any endpoints that allow tool invocation or command execution.
- Monitor system logs for unusual command execution patterns or unexpected process spawning on affected servers.
- Review container configurations to ensure that applications do not run with root privileges where possible.
Step-by-step guide: Patch Management: Definition, Purpose and Operational Reality
General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Langchain-Chatchat are affected by CVE-2026-75128?
All versions of Langchain-Chatchat up to and including 0.3.1.3 are affected by this vulnerability.
Is there a patch available for CVE-2026-75128?
The source material does not confirm the availability of a fix or update for this vulnerability.
What is the severity rating of this vulnerability?
The National Vulnerability Database rates CVE-2026-75128 as critical with a CVSS score of 9.3.
