Database/AI/ML frameworks & serving
Langchain-Chatchat: unauthenticated /tools/call invokes the shell tool for remote command execution
Impact
A single unauthenticated HTTP POST naming the always-registered shell tool runs arbitrary OS commands as the server user, which is root in the shipped Docker image. On a GPU node this is immediate code execution next to the model weights, the dataset mounts and any service-account token the pod carries, with no credential to steal first. Anything reachable from that container - registry pulls, object storage, cluster API - inherits the compromise. Retrieval/chat deployments of this kind are often parked on a shared inference node, so one exposed port can mean the whole node must be considered dirty.
Who can reach it
Anyone who can reach the Chatchat API port over the network. No authentication is required.
What to do
The record names no fixed version - all releases through 0.3.1.3 are affected. Take the API off any network a tenant or the internet can reach, put authentication in front of it, and remove the shell tool from the registered tool set. Stop and redeploy affected instances rather than leaving them listening; do not run the container as root.
References
Related entries
- LMDeploy: unauthenticated p2p endpoints let a remote peer deliver a pickle payload for engine RCECVE-2026-76850 · LMDeploy (disaggregated serving ZMQ peer channel)Critical
- Headroom: client-supplied x-headroom-user-id header is trusted as identity, exposing other users' memoryCVE-2026-77776 · Headroom LLM proxy (x-headroom-user-id header treated as identity)Critical
- DB-GPT: shipped docker-compose sets a static MySQL root password and publishes 3306 on all interfacesCVE-2026-77933 · DB-GPT default docker-compose deployment (MySQL root credentials)Critical
- llama.cpp llama-server: use-after-free and double free in the chat tool-call parser reachable from /completionCVE-2026-107183 · llama.cpp llama-server (common_chat_peg_mapper::map tool-call parser)Critical
- SGLang: unauthenticated debug dumper endpoint executes Python in the scheduler processCVE-2026-111391 · SGLang debug dumper (/dumper/configure filter expression)Critical
- vLLM: request-controlled processor code_revision loads arbitrary remote model code, giving RCECVE-2026-114053 · vLLM OpenAI-compatible API server (mm_processor_kwargs.code_revision handling)Critical
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.