CVE-2026-109442: piflow 2.0.0 through 2.0.1 Unauthenticated RCE via Chat Agent exec_shell
piflow 2.0.0 through 2.0.1 contains a remote code execution vulnerability in its DeepAgents chat agent, whose POST /chat and POST /chat/stream endpoints lack authentication. Attackers can instruct the agent to call the execshell tool, which runs arbitrary commands via subprocess.run without human approval or an allow-list, exposing environment secrets such as LLM API keys and database credentials.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Any deployment of piflow 2.0.0 through 2.0.1 that makes the unauthenticated POST /chat or POST /chat/stream endpoints reachable by an attacker is exposed. No credentials or user interaction are required.
What does an attacker need to do to achieve code execution?
An attacker only needs network access to either affected chat endpoint and must submit instructions that cause the DeepAgents chat agent to invoke its exec_shell tool. The tool executes arbitrary commands through subprocess.run without human approval or an allow-list.
What data and systems could be affected after exploitation?
Successful exploitation can provide arbitrary command execution in the piflow runtime environment. This can expose environment secrets, including LLM API keys and database credentials, and can affect confidentiality, integrity, and availability.
How can I determine whether my deployment is affected?
Check whether the deployment runs piflow 2.0.0 or 2.0.1 and whether POST /chat or POST /chat/stream can be reached without authentication. Also verify whether the deployed chat agent has access to the exec_shell tool.