Critical RCE Flaw in Langflow AI Enables Full Server Compromise and Data Theft

Summary

A severe security breach has been identified within Langflow AI's platform, which facilitates the creation of AI-powered agents and workflows. Versions before 1.9.0 are susceptible to a critical vulnerability that enables unauthenticated remote code execution (RCE). Attackers can exploit this by sending crafted requests to execute arbitrary Python code on vulnerable systems. This flaw has been actively exploited in the wild, posing significant risks such as full server compromise, data exfiltration, and lateral movement within networks.

What Happened

The vulnerability stems from an endpoint (/api/v1/build_public_tmp/{flow_id}/flow) that allows building public flows without authentication. When the optional data parameter is supplied, it accepts attacker-controlled flow data containing arbitrary Python code in node definitions. This data is executed with zero sandboxing using Python's exec() function, leading to unauthenticated RCE.

Technical Details

The vulnerability is distinct from a previously patched issue (CVE-2025-3248) that added authentication to another endpoint (/api/v1/validate/code). The affected endpoint is designed for public flows and should not require authentication. However, it incorrectly accepts attacker-supplied data containing executable code. This flaw allows attackers to execute arbitrary Python code on the server, leading to potential full system compromise.

The exploit involves several steps:

1. Obtain a Public Flow ID: Attackers can discover or create a public flow using shared links or by exploiting the AUTO_LOGIN feature.
2. Exploit via Unauthenticated RCE: Crafted malicious data is sent to the vulnerable endpoint, executing arbitrary code on the server.

Affected Products and Fixed Versions

• Product: Langflow
• Vulnerable Versions: Prior to 1.9.0
• Fixed Version: 1.9.0

Exploitation Status

The vulnerability has been actively exploited in the wild, as confirmed by multiple successful remote code execution attempts during testing.

Indicators of Compromise

Indicators include unauthorized access to server processes and unexpected file modifications on the server, such as the creation of /tmp/rce-proof.

Detection Opportunities

Organizations can detect potential exploitation by monitoring for unusual activity related to the /api/v1/build_public_tmp/{flow_id}/flow endpoint. Logs should be reviewed for unauthorized access attempts or execution of arbitrary code.

Timeline

• Vulnerability Discovery: June 2026
• Patch Release: Langflow version 1.9.0

Why This Matters for Defenders

This vulnerability poses a severe threat due to its potential for full server compromise and data exfiltration. It highlights the importance of timely patching and rigorous input validation in software development.

What Remains Unclear

While the technical details of the exploit are well-documented, it remains unclear how widely this vulnerability has been exploited beyond confirmed cases. Further investigation is needed to assess the full impact on affected systems.

Defender Guidance

1. Patch Immediately: Upgrade to Langflow version 1.9.0 or later to mitigate the vulnerability.
2. Monitor Logs: Review server logs for unauthorized access attempts and unusual activity related to the /api/v1/build_public_tmp/{flow_id}/flow endpoint.
3. Restrict Access: Limit access to critical endpoints and ensure proper authentication mechanisms are in place.

Proof of Concept

A working proof-of-concept is published at GitHub Advisory. This includes detailed steps for exploiting the vulnerability, demonstrating its critical nature and ease of exploitation.