CVE-2026-75128Published
Langchain-Chatchat through 0.3.1.3 Unauthenticated RCE via /tools/call Endpoint
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-75128 · Microsoft / collected KEV context
cve-program · CVE-2026-75128
- https://www.lasso.security/vulnerability-database/cve-2026-75128
- https://github.com/chatchat-space/Langchain-Chatchat/blob/a6a9193b5002061719f0eee62c6310bd5b1b7f63/libs/chatchat-server/chatchat/server/api_server/tool_routes.py#L33
- https://www.vulncheck.com/advisories/langchain-chatchat-through-0.3.1.3-unauthenticated-rce-via-tools-call-endpoint
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.