CVE-2026-75128
Langchain-Chatchat through 0.3.1.3 exposes a POST /tools/call API endpoint that invokes any…
- Risk score
- 72/100
- CVSS
- 9.8 v3.1
- Exploit chance (30 days)
- 0.5%
- Published
- 20 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Langchain-Chatchat versions 0.3.1.3 and below expose a POST /tools/call API endpoint that can be exploited by remote attackers to execute arbitrary OS commands as the server user. This is due to the shell tool being always registered and callable without authentication.
- Affected
- {'products': ['Langchain-Chatchat'], 'packages': [], 'versions': ['0.3.1.3 and below']}
- Fix
- Check the linked advisory for a fix, as none is provided in the record.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 9.8 critical
- Remotely exploitable without logging in
References
- https://github.com/chatchat-space/Langchain-Chatchat/blob/a6a9193b5002061719f0eee62c6310bd5b1b7f63/libs/chatchat-server/chatchat/server/api_server/tool_routes.py#L33
- https://www.lasso.security/vulnerability-database/cve-2026-75128
- https://www.vulncheck.com/advisories/langchain-chatchat-through-0.3.1.3-unauthenticated-rce-via-tools-call-endpoint
Original description
Langchain-Chatchat through 0.3.1.3 exposes a POST /tools/call API endpoint that invokes any registered tool by name without authentication, leaving the always-registered shell tool callable. Remote attackers can send a single request naming the shell tool to execute arbitrary OS commands as the server user (root in the shipped Docker image).
Last activity 20 Oct 2026. Patch Forecast updates every hour.