Penetration testing usually starts with expensive tooling. This one starts with a single POST: on October 20, 2026, CVE-2026-75128 showed that Langchain-Chatchat's POST /tools/call endpoint runs any tool for anyone, with no login at all. Pick your agent framework below, run the exact probe commands against your own deployment, paste back what happened, and get a straight verdict: exposed, auth-required, or not present.
Short answer: yes, it can be. CVE-2026-75128 is an unauthenticated tool-call endpoint in Langchain-Chatchat: a POST to /tools/call executes a named tool with attacker-supplied arguments and returns the output, no session, no token, no login. VulnCheck scored it CVSS 9.8 — 98% of the maximum severity score. If your agent app answers the probes below without credentials, it is an unauthenticated shell with your tools inside it.
On October 20, 2026, CVE-2026-75128 was published for Langchain-Chatchat, the open-source knowledge-base agent app built on LangChain. Per VulnCheck's advisory (GHSA-5rx2-xp53-9x5r), the application's POST /tools/call endpoint executes whichever tool the caller names, with whatever arguments the caller supplies, and it performs no authentication check first. The CVSS score is 9.8 out of 10, per VulnCheck — near the top of the scale because the attack needs no privileges, no user interaction, and works over the network.
Two days later, on October 22, 2026, Sekoia reported attackers actively harvesting credentials from exposed Flowise servers — the same underlying mistake in a different framework: an agent builder left reachable on the internet, holding API keys and workflow credentials, answering requests it should never have answered. Chatchat and Flowise are different codebases, but the failure is one pattern: agent apps ship with powerful tool endpoints, developers expose them for convenience, and the tools inside — file access, code execution, database queries, web requests — become available to whoever finds the port.
That is why this page is a probe, not a quiz. Exposure is a fact about your deployment, not a feeling, and the only honest way to know is to ask your own server the attacker's question — a tool call with no credentials — and read its answer.
An unauthenticated tool-call endpoint is an HTTP route that executes an AI agent's tools — shell commands, file reads, database queries, API calls — without verifying who is asking. The agent framework treats the endpoint as an internal convenience for its own front end, but once the app is reachable on a network, the endpoint is public. Anyone who can reach the port can enumerate the tool list and invoke tools directly, bypassing the chat interface, the prompt, and every guardrail written into the system prompt, because none of those sit between the network and the tool runner.
Step 1: choose the framework your agent app runs on. The page lists the exact probe paths for that framework with copy-ready curl commands pointed at your own deployment. Step 2: run them — with no credentials attached. Step 3: report what came back and the interpreter returns a verdict with the fix.
Honest scope note: this interpreter judges only the probe results you enter, for the paths listed. Framework versions differ, reverse proxies change behaviour, and an endpoint can be closed while a sibling route stays open — run every probe for your framework, not just the first. The full tool is the open-source agent-toolcall-exposure-scanner repo by Ingenious AI, which probes the full route map and checks response bodies automatically.
| Verdict | What your server just told you | The fix |
|---|---|---|
| EXPOSED | A tool, prediction or chat endpoint answered 2xx to a request carrying no credentials. The endpoint is public and the tools behind it are callable by anyone who finds the port. | Enable the framework's authentication today, bind the app to localhost or a private network until then, and audit access logs for tool calls you do not recognize. |
| AUTH ENFORCED | The endpoint refused the unauthenticated request with 401 or 403. This is the correct behaviour — the one missing in CVE-2026-75128. | Keep it, and re-probe after every upgrade or config change; auth defaults reset silently more often than teams expect. |
| NOT PRESENT | The probed path returned 404 or 405 on your deployment. That specific route is not exposed — under that name, on that port. | Run the remaining probes, check alternate ports and path prefixes, and confirm the app is not also exposed under a second deployment. |
If any probe came back EXPOSED, treat the deployment as public from this minute and work this list in order:
/tools/call, prediction and chat endpoints from addresses you do not recognize. Sekoia's October 22, 2026 reporting shows exposed agent servers are found and harvested, not stumbled on.CVE-2026-75128 is an unauthenticated tool-execution flaw in Langchain-Chatchat, published on October 20, 2026 and scored CVSS 9.8 by VulnCheck (GHSA-5rx2-xp53-9x5r). A POST to /tools/call runs a named tool with caller-supplied arguments and returns the output, with no login, token or session check in front of it.
Send the tool endpoint a request with no credentials attached — no Authorization header, no cookie, no API key — ideally from a different machine. A 2xx with real output means exposed; a 401 or 403 means auth is enforced; a 404 means that path is absent. The probe commands above are built for exactly this test.
The pattern is not one vendor's bug. CVE-2026-75128 is Langchain-Chatchat, Sekoia reported exposed Flowise servers being harvested on October 22, 2026, and any framework — DB-GPT, custom LangChain apps, LangServe deployments — that serves tool or prediction endpoints without authentication has the same shape. Test the deployment, not the brand.
It helps a great deal, because the endpoint stops being internet-reachable, but it is not the whole fix. Anyone or anything inside the network — a compromised laptop, a malicious insider, another exposed service — can still call the tools. Enable the framework's own authentication as well, so the endpoint checks credentials regardless of network position.
This page interprets the probe results you enter for the main paths of four frameworks. The full agent-toolcall-exposure-scanner probes the complete route map of a deployment, inspects response bodies for real tool output automatically, and checks alternate ports and prefixes — use it for a thorough audit before you conclude a deployment is clean.