Critical RCE Flaw in Langchain-Chatchat Allows Unauthenticated Command Execution

Remote attackers can execute arbitrary operating system commands on servers running Langchain-Chatchat through version 0.3.1.3 by exploiting a critical authentication bypass. The flaw, tracked as CVE-2026-75128, allows unauthenticated access to a sensitive API endpoint that invokes registered tools.

The vulnerability stems from the POST /tools/call API endpoint, which fails to require authentication before executing requests. According to the National Vulnerability Database record, this endpoint allows callers to invoke any registered tool by name. The shell tool is always registered by default in the affected software, making it directly accessible to remote attackers without credentials.

Technical Details and Severity

The weakness is classified under CWE-306, which relates to incorrect default permissions. The Common Vulnerability Scoring System assigns this flaw a score of 9.3, placing it in the critical severity range. This high rating reflects the ease of exploitation and the significant impact on system integrity and confidentiality.

Attackers need only send a single HTTP request to the vulnerable endpoint. By specifying the name of the shell tool in the request, they can trigger command execution. The commands run with the privileges of the server user. In the shipped Docker image for Langchain-Chatchat, this user is root, granting the attacker full control over the containerized environment.

Affected Versions and Scope

The issue affects all versions of Langchain-Chatchat up to and including 0.3.1.3. The project name appears in various forms, including chatchat-space Langchain-Chatchat, in vulnerability databases. Any deployment using these versions that exposes the API endpoint to untrusted networks is at risk.

The National Vulnerability Database lists the affected product as Langchain-Chatchat. The description explicitly states that the flaw exists in versions through 0.3.1.3. Organizations using older or newer versions should verify their specific build, but the record confirms the risk for the stated range. No patch or fix has been confirmed yet by the vendor in the provided source material.

What should you do?

Security teams should immediately audit their deployments of Langchain-Chatchat to determine if they are running vulnerable versions. If the software is exposed to external networks, the risk of remote code execution is immediate. Administrators should consider isolating the service or blocking access to the /tools/call endpoint until a vendor update is available.