CVE-2026-75128 in Langchain-Chatchat
Summary
by MITRE • 10/20/2026
Langchain-Chatchat through 0.3.1.3 exposes a POST /tools/call API endpoint that invokes any registered tool by name without authentication, leaving the always-registered shell tool callable. Remote attackers can send a single request naming the shell tool to execute arbitrary OS commands as the server user (root in the shipped Docker image).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
The vulnerability identified in Langchain-Chatchat versions up to 0.3.1.3 represents a critical authentication bypass and insecure direct object reference flaw within its API infrastructure. The application exposes an HTTP POST endpoint at /tools/call which is designed to invoke registered tools by name. However, the implementation fails to enforce any form of access control or user authentication on this specific route. This architectural oversight allows unauthenticated remote actors to interact directly with the underlying tool execution engine. Because the shell tool is always registered within the default configuration and lacks protective measures such as input sanitization or command restrictions, it becomes a persistent attack vector available to anyone who can reach the server network interface.
From a technical perspective, this flaw constitutes an arbitrary code execution vulnerability facilitated by improper access control mechanisms. When a remote attacker sends a single POST request specifying shell as the target tool and providing malicious arguments in the payload, the application processes these inputs without verifying the identity or privileges of the requester. The system then passes these commands directly to the operating system's command interpreter for execution. In environments where Langchain-Chatchat is deployed using its default Docker image configuration, the server process typically runs with elevated privileges, often as the root user. Consequently, any OS command executed through this vector inherits these high-level permissions, granting the attacker full control over the host system.
The operational impact of this vulnerability is severe and potentially catastrophic for affected deployments. An unauthenticated adversary can achieve complete remote code execution on the vulnerable server without needing valid credentials or prior reconnaissance beyond identifying the API endpoint. This capability allows attackers to exfiltrate sensitive data stored on the machine, install persistent backdoors such as reverse shells or cryptominers, pivot into internal networks if the host is accessible from other segments, and modify system configurations to maintain access. The lack of authentication means that this exploit can be automated at scale by threat actors scanning for vulnerable instances across the internet, leading to widespread compromise of infrastructure relying on this framework.
This vulnerability aligns with CWE-287 Improper Authentication and CWE-94 Command Injection as defined in the Common Weakness Enumeration standards. The failure to verify user identity before allowing tool invocation is a classic authentication bypass scenario, while the execution of arbitrary OS commands via unsanitized input represents a direct command injection flaw. In terms of tactical classification under MITRE ATT&CK, this behavior maps directly to T1059 Command and Scripting Interpreter for executing system-level commands and potentially T1621 Multi-Stage Request Chains if used in conjunction with other exploitation techniques. The unrestricted nature of the shell tool usage also reflects aspects of CWE-78 Improper Neutralization of Special Elements used in an OS Command, although the primary driver is the lack of access control rather than input sanitization alone.
Mitigation strategies must prioritize immediate isolation and configuration hardening. Organizations should immediately restrict network access to the /tools/call endpoint using firewall rules or reverse proxy configurations that require valid authentication tokens before allowing requests to reach the application layer. Updating Langchain-Chatchat to a version where this vulnerability has been patched is essential, as newer releases likely implement proper middleware for request validation and tool-specific permission checks. Additionally, administrators should review Docker container security practices by ensuring services do not run with root privileges unless absolutely necessary, utilizing non-root users within containers to limit the blast radius of any successful exploitation. Input validation on all API endpoints remains a critical defense-in-depth measure, even when authentication is enforced, to prevent potential command injection if other tools are similarly misconfigured in future updates or custom deployments.