CVE-2026-75128: Unauthenticated RCE in Langchain-Chatchat — Detection and Remediation Guide

---
title: Langchain-Chatchat Web Process Spawning Shell - CVE-2026-75128
id: 3f8a1c72-5b94-4d21-9e67-8a2c4f1b9d03
status: experimental
description: Detects the Langchain-Chatchat Python/uvicorn server process spawning a shell or command interpreter, consistent with exploitation of the unauthenticated /tools/call shell tool (CVE-2026-75128).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-75128
  - https://attack.mitre.org/techniques/T1059/004/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/python'
      - '/python3'
      - '/python3.10'
      - '/python3.11'
      - '/python3.12'
      - '/uvicorn'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/ash'
      - '/zsh'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/id'
      - '/whoami'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate plugin or tooling integrations that shell out from the application server - investigate parent working directory and command line before tuning
level: high
---
title: HTTP POST to Langchain-Chatchat Tools Call Endpoint - CVE-2026-75128
id: 91c4e6a8-2d07-4f3b-b851-6c9d3a7e52f4
status: experimental
description: Detects inbound POST requests to the /tools/call API endpoint, the exploitation vector for unauthenticated remote command execution in Langchain-Chatchat (CVE-2026-75128).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-75128
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection:
    cs-method: 'POST'
    cs-uri-stem|contains: '/tools/call'
  condition: selection
falsepositives:
  - Legitimate internal application usage of the tools API - verify source IP is an authorized internal client and confirm the instance is patched
level: critical
---
title: Reverse Shell or Download Activity from Python Web Server
id: b47d2f19-8c35-4a6e-9d12-5e8f0b3a71c6
status: experimental
description: Detects common post-exploitation command lines (reverse shells, payload downloads) executed under a Python web server process, indicative of successful CVE-2026-75128 exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-75128
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.command_and_control
  - attack.t1071.001
  - attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentCommandLine|contains:
      - 'chatchat'
      - 'uvicorn'
  selection_payload:
    CommandLine|contains:
      - '/dev/tcp/'
      - 'bash -i'
      - 'nc -e'
      - 'ncat -e'
      - 'curl http'
      - 'wget http'
      - 'chmod +x /tmp'
      - 'base64 -d'
  condition: selection_parent and selection_payload
falsepositives:
  - Rare; any match warrants immediate investigation
level: critical

// Hunt 1: Inbound POST requests to the /tools/call endpoint (web/proxy/firewall logs ingested as CommonSecurityLog or Syslog)
CommonSecurityLog
| where TimeGenerated > ago(14d)
| where RequestMethod =~ "POST"
| where RequestURL contains "/tools/call"
| project TimeGenerated, SourceIP, SourcePort, DestinationIP, DestinationHostName, RequestURL, RequestMethod, DeviceAction
| sort by TimeGenerated desc
;
// Hunt 2: Shell or post-exploitation processes spawned by the Python/chatchat server on Linux hosts (Syslog or Defender process events)
Syslog
| where TimeGenerated > ago(14d)
| where ProcessName in~ ("sh", "bash", "dash", "curl", "wget", "nc", "ncat", "id", "whoami")
| where SyslogMessage has_any ("chatchat", "uvicorn") or SyslogMessage has_any ("/dev/tcp/", "bash -i", "nc -e")
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| sort by TimeGenerated desc
;
// Hunt 3: Defender for Endpoint - shell children of python/uvicorn processes
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName has_any ("python", "python3", "uvicorn")
| where FileName in~ ("sh", "bash", "dash", "curl", "wget", "nc", "ncat", "id", "whoami", "chmod")
| project TimeGenerated, DeviceName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName
| sort by TimeGenerated desc

-- Hunt for shell/process descendants of the Langchain-Chatchat Python server and its network connections
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE (Name =~ '(?i)sh$|bash|dash|curl|wget|nc|ncat|id$|whoami'
   OR CommandLine =~ '(?i)/dev/tcp/|bash -i|nc -e|curl http|wget http')
   AND Ppid IN (
       SELECT Pid FROM pslist()
       WHERE CommandLine =~ '(?i)chatchat|uvicorn'
   )

-- Also enumerate listening sockets owned by the server to confirm exposure
SELECT Pid, Name, CommandLine, Family, Type, Status, Laddr, Lport
FROM netstat()
WHERE CommandLine =~ '(?i)chatchat|uvicorn'
   AND Status =~ 'LISTEN'

#!/usr/bin/env bash
# CVE-2026-75128 verification and hardening for Langchain-Chatchat deployments
# Run on the host (or inside the container) as root.
set -euo pipefail

# 1. Identify running Langchain-Chatchat instances and their version
ps aux | grep -Ei 'chatchat|startup.py|uvicorn' | grep -v grep || echo "No chatchat processes found on host."
docker ps --format '{{.Names}} {{.Image}}' 2>/dev/null | grep -i chatchat || echo "No chatchat containers found."
pip show langchain-chatchat 2>/dev/null | grep -E '^(Name|Version)' || true

# 2. Check whether the API port is exposed beyond localhost
ss -tlnp | grep -E ':7861|:8501' || echo "Default chatchat ports not listening."

# 3. Emergency mitigation: block inbound access to the tools API at the host firewall
# (Only apply if the instance cannot be patched immediately.)
iptables -C INPUT -p tcp --dport 7861 ! -s 127.0.0.1 -j DROP 2>/dev/null || \
iptables -I INPUT -p tcp --dport 7861 ! -s 127.0.0.1 -j DROP
echo "Firewall drop rule applied for inbound 7861 (non-localhost)."

# 4. Review recent access logs for exploitation attempts
grep -E 'POST.*/tools/call' /var/log/nginx/access.log /var/log/apache2/access.log 2>/dev/null || \
echo "No matches in common reverse-proxy logs; check application/container logs directly: docker logs <container> | grep '/tools/call'"

# 5. Upgrade to the fixed release (check the project advisory for the patched version > 0.3.1.3)
pip install --upgrade langchain-chatchat
# For container deployments, pull the patched image, recreate the container, and run as non-root:
# docker pull <patched-image>
# docker run --user 1000:1000 --read-only --cap-drop ALL ...