CVE-2026-82278: BISHENG Authenticated Arbitrary Python Code Execution via Workflow run_once
BISHENG before 2.6.0 contains a remote code execution vulnerability in the workflow runonce endpoint that allows authenticated users to execute arbitrary Python code. Attackers can submit crafted Code node definitions to the POST /api/v1/workflow/runonce endpoint, which executes them with exec() without sandboxing, gaining access to filesystem, credentials, and internal network resources.
Affected Software
Event History
Frequently Asked Questions
Which versions should be considered affected?
BISHENG versions before 2.6.0 are affected.
Does exploitation require an authenticated account?
Yes. An attacker needs to be authenticated to submit the malicious workflow definition.
What request path is involved in exploitation?
The vulnerable path is POST /api/v1/workflow/run_once. Crafted Code node definitions submitted to this endpoint are executed through exec() without sandboxing.
What could an attacker access after successful exploitation?
The attacker can execute arbitrary Python code and may access the filesystem, credentials, and internal network resources available to the BISHENG process.