CVE-2026-13448: Unauthenticated Remote Code Execution in Langflow OSS via Public-Flow Blacklist Bypass

(Updated: )
CVE Reports
, , , , ,

Summary

CVE-2026-13448 is an unauthenticated remote code execution vulnerability in Langflow OSS, the open-source visual framework for building LLM applications maintained by Langflow-AI. Affected versions span the OSS release range 1.0.0 through 1.10.1 (Docker Hub tag langflowai/langflow:1.0.0–1.10.1, GitHub tag v1.0.0–v1.10.1). The flaw stems from a public-flow validation guard that uses an incomplete blacklist of components capable of server-side code execution. Because CSVAgent is omitted from that blacklist, a flow marked access_type=PUBLIC can be built by an unauthenticated requester, and the agent’s underlying tool executes attacker-supplied Python inside the Langflow server process. The vulnerability is resolved in Langflow 1.10.2. The source report did not provide a CVSS score or severity rating; none was inferred.

Root cause

Langflow exposes POST /api/v1/build_public_tmp/{flow_id}/flow, an endpoint that allows builds of flows with access_type=PUBLIC to be triggered without authentication. When a public build runs, flow components execute inside the Langflow server process.

To prevent abuse, the function validate_public_flow_no_code_execution() — defined in src/lfx/src/lfx/utils/flow_validation.py and called from src/backend/base/langflow/api/v1/chat.py — inspects the flow’s component list and rejects flows containing known code-execution components. However, this guard is implemented as a blacklist, and the blacklist is incomplete.

The blacklist covers:

  • Code-execution components: PythonREPLComponent, PythonREPLTool, PythonCodeStructuredTool, and Smart Transform.
  • Flow-reference components: RunFlow, SubFlow, and FlowTool.

It does not cover several Agent components that are also capable of executing arbitrary Python server-side. The report specifically identifies CSVAgent as one such omission. CSVAgent is built on langchain_experimental and uses PythonAstREPLTool with allow_dangerous_code=True, meaning it will execute Python code supplied to it during agent reasoning. CodeActAgentSmolagents and OpenDsStarAgent were also identified as absent from the blacklist, though the report notes their runtime dependencies are not installed in the official image, so they were not used in the demonstrated attack chain.

Attack path and prerequisites

The attack requires two phases: an initial setup performed by a legitimate authenticated user, and an unauthenticated trigger.

Setup (authenticated). A user with any legitimate Langflow account creates a flow containing two components:

  1. An OpenAIModel component with openai_api_base pointing to an attacker-controlled OpenAI-compatible endpoint.
  2. A CSVAgent component configured with agent_type=zero-shot-react-description and allow_dangerous_code=True.

A small CSV file is uploaded for the agent, and the flow is set to access_type=PUBLIC.

Trigger (unauthenticated). An attacker who learns or guesses the flow_id calls POST /api/v1/build_public_tmp/{flow_id}/flow with no Authorization header. Because CSVAgent is absent from the validation blacklist, the build is permitted. During the public build, the CSVAgent sends a request to the attacker’s fake LLM endpoint. That endpoint returns a ReAct step of the form Action: python_repl_ast / Action Input: <arbitrary Python code>. PythonAstREPLTool then executes the supplied code inside the Langflow server process, achieving remote code execution for the triggering request — without authentication.

Prerequisites. The attack depends on several conditions:

  • A legitimate Langflow account is needed to create and configure the PUBLIC flow. Authentication is required only for setup; the vulnerability-triggering request itself is unauthenticated.
  • The attacker must operate an OpenAI-compatible LLM endpoint reachable by the Langflow server.
  • A small CSV file must be uploaded to the flow for the CSVAgent component.
  • The target flow must be set to access_type=PUBLIC.
  • The langchain_experimental package (bundled with CSVAgent) must be available in the Langflow installation.

Affected scope

Affected versions: Langflow OSS 1.0.0 through 1.10.1. The report states only the range endpoints; it does not enumerate every intermediate release between them.

Fixed versions: Langflow 1.10.2, where public flows containing code-execution components raise PublicFlowValidationError and are rejected before any component executes.

Impact. The vulnerability enables unauthenticated remote code execution: arbitrary Python code runs inside the Langflow server process or container when the unauthenticated public build is triggered. The attacker-controlled code executes with the privileges of the Langflow service account, yielding full server-side compromise. The triggering request requires no authentication; only the initial flow setup requires a legitimate account.

Detection

Defenders can look for the following signals:

  • Unauthenticated public-build requests. Monitor for requests to POST /api/v1/build_public_tmp/{flow_id}/flow that carry no Authorization header. Under normal conditions, public builds should be rare and attributable to expected workflows; a spike or unexpected source warrants investigation.
  • Rejected-build alerts on fixed versions. On Langflow 1.10.2, exploitation attempts against public flows containing code-execution components are rejected with an HTTP 4xx response and a message that code-execution components are not allowed (PublicFlowValidationError). Alerting on these rejections can surface attempted exploitation after upgrade.
  • PUBLIC-flow audits. Audit flows with access_type=PUBLIC for the presence of Agent components not covered by the legacy blacklist — in particular CSVAgent, CodeActAgentSmolagents, and OpenDsStarAgent.
  • Outbound connection monitoring. Monitor the Langflow server process for unexpected outbound connections to non-standard OpenAI-compatible API endpoints. Such connections may indicate a fake LLM endpoint being used to drive code execution during a public build.

Remediation

  • Upgrade to Langflow 1.10.2. In the fixed release, public flows containing code-execution components raise PublicFlowValidationError and are rejected before any component executes, closing the bypass.
  • Restrict the public-build endpoint. If upgrading is not immediately possible, restrict network access to /api/v1/build_public_tmp/ and disable or closely audit PUBLIC flows.
  • Tighten the validation blacklist. Review the flow validation blacklist to cover all Agent components capable of server-side code execution, not just the originally listed set. A blacklist-only approach remains fragile; consider whether an allowlist model would better suit the public-build trust boundary.

References