Skip to navigation

Threat reportVulnerabilityTL-2026-2438

Endor Labs Discloses 14 Critical/High Vulnerabilities Across Seven AI Orchestration Platforms (NocoBase, Flowise, Langflow, Dify, Activepieces, Kestra, Apache Airflow)

criticalACTIVE

Endor Labs researcher Peyton Kennedy disclosed 14 critical/high vulnerabilities across seven AI agent/workflow orchestration platforms that treat multi-tenant, code-executing environments as single-user developer tools. Flowise, Kestra, and Langflow are exploitable pre-authentication via prompt injection leading to remote code execution, and Flowise's repository was archived on 2026-08-13, leaving its flaws permanently unpatched.

Key facts for Flowise unpatched workflow RCE

IdentifiersTL-2026-2438, CVE-2026-41641, CVE-2026-41640, CVE-2026-73083, CVE-2026-73081, CVE-2026-30898, CVE-2026-73487
SeverityCRITICAL
CVSS9.3
Exploitation statusPublic proof-of-concept exploit
EPSSCVE-2026-41640: 1.8% (78.1th percentile); CVE-2026-41641: 1.8% (77.6th percentile); CVE-2026-73487: 0.9% (59.4th percentile)
Affected productsNocoBase NocoBase; FlowiseAI Flowise / flowise-components (npm); Langflow Langflow (Smart Transform / LambdaFilterComponent); Langgenius dify-sandbox; Activepieces Activepieces; Kestra Kestra (interpreter property / beforeCommands + default webhook trigger); Apache Software Foundation Apache Airflow (BashOperator)
Weaknesses (CWE)CWE-89, CWE-284, CWE-78, CWE-77, CWE-693, CWE-95, CWE-94, CWE-668
MITRE ATT&CK techniquesT1005 Data from Local System, T1027 Obfuscated Files or Information, T1041 Exfiltration Over C2 Channel, T1059.004 Unix Shell, T1059.006 Python, T1059.007 JavaScript, T1082 System Information Discovery, T1190 Exploit Public-Facing Application, T1552.001 Credentials In Files, T1611 Escape to Host
MotivationUNKNOWN
Target sectorstechnology, softwaredevelopment, cross-sector
Target regionsGlobal
Detection rules9 (1 shown free)
Sources16 cited sources

Detection coverage for Flowise unpatched workflow RCE

As of 2026-11-01, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2438 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Flowise Unauthenticated Prediction Endpoint — Obfuscated Python Validator Bypass (CVE-2026-73487)

Detects inbound requests to Flowise's unauthenticated /api/v1/prediction/<uuid> endpoint carrying obfuscated Python payloads (chr()-based string construction, importlib in place of import, pandas SSRF via read_csv/read_json, or numpy.ctypeslib) that bypass the Pyodide sandbox's regex-based validator — the pre-auth prompt-injection-to-RCE chain disclosed in GHSA-w7x8-q2gp-5cgg.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1190, T1059.006, T1027
  • Data sources: web_proxy, flowise_application_logs, waf_logs
  • Severity: critical
  • Confidence: high

Splunk SPL

index=web_proxy (sourcetype=nginx:access OR sourcetype=apache:access OR sourcetype=proxy)
| regex uri_path="\/api\/v1\/prediction\/[0-9a-fA-F-]{36}"
| eval decoded_body=urldecode(coalesce(http_request_body, form_data, uri_query))
| where match(decoded_body, "(?i)chr\(\s*\d+\s*\)") OR match(decoded_body, "(?i)importlib") OR match(decoded_body, "(?i)pd\.read_(csv|json)\(") OR match(decoded_body, "(?i)numpy\.ctypeslib")
| stats count as hits min(_time) as first_seen max(_time) as last_seen values(uri_path) as uri_path values(http_user_agent) as user_agent by src_ip, dest_ip
| where hits > 0
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

AppServiceHTTPLogs
| where TimeGenerated > ago(24h)
| where CsUriStem matches regex @"/api/v1/prediction/[0-9a-fA-F-]{36}"
| extend DecodedQuery = url_decode(CsUriQuery)
| where DecodedQuery has_any ("chr(", "importlib", "pd.read_csv(", "pd.read_json(", "numpy.ctypeslib")
| summarize RequestCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), UserAgents = make_set(CsUserAgent) by CIp, CsUriStem
| where RequestCount > 0

Sigma

title: Flowise Unauthenticated Prediction Endpoint Python Validator Bypass
id: 7f3e9a2c-4b1d-4e6a-9c3f-1a2b3c4d5e01
status: experimental
description: Detects unauthenticated exploitation of Flowise's /api/v1/prediction/<uuid> endpoint using obfuscated Python (chr()-based strings, importlib, pandas SSRF read_csv/read_json, numpy.ctypeslib) to bypass the Pyodide sandbox validator (CVE-2026-73487).
references:
    - https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-w7x8-q2gp-5cgg
    - https://www.endorlabs.com/learn/hacking-your-life-with-ai-can-get-you-hacked
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-10
tags:
    - attack.initial-access
    - attack.t1190
    - attack.execution
    - attack.t1059.006
    - attack.defense-evasion
    - attack.t1027
    - attack.tool.flowise
    - cve.2026.73487
logsource:
    category: webserver
detection:
    selection_uri:
        cs-uri-stem|re: '/api/v1/prediction/[0-9a-fA-F-]{36}'
    selection_payload:
        cs-uri-query|contains:
            - 'chr('
            - 'importlib'
            - 'pd.read_csv('
            - 'pd.read_json('
            - 'numpy.ctypeslib'
    condition: selection_uri and selection_payload
falsepositives:
    - Legitimate chatflows loading allow-listed internal CSV/Airtable data sources
level: critical

Known false positives:

  • Legitimate data-science chatflows that load CSV/Airtable data via read_csv/read_json against internal, allow-listed URLs
  • Authorized penetration testers exercising the same validator-bypass patterns during a sanctioned engagement

Tuning notes: Scope to hosts known to run Flowise/flowise-components (join against asset inventory); allow-list internal URLs used by legitimate read_csv/read_json calls; escalate to critical if the same src_ip also appears in TL-2026-2438-KQL-003 (outbound C2/exfil).

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • [indicator] [indicator] SQL Injection Escalating to COPY ... TO PROGRAM (CVE-2026-41641 / CVE-2026-41640) · unlock with TL Creds
  • [indicator] importFresh() V8 Isolate Bypass — Host Node Process Spawning child_process (CVE-2026-73083) · unlock with TL Creds
  • [indicator]/[indicator] Sandbox Escape to Host — Outbound C2 and CSV/Airtable Data Exfiltration · unlock with TL Creds
  • [indicator] Unauthenticated Webhook Trigger Command Injection (interpreter / beforeCommands → bash -c) · unlock with TL Creds
  • [indicator] SES Compartment Escape Post-Exploitation Recon (whoami/id/uname after disabled lockdown()) · unlock with TL Creds
  • Obfuscated chr()-Based Python Runtime String Construction Executing OS Commands · unlock with TL Creds
  • Dify Sandbox Preload Executing as Root Before Seccomp/Chroot Apply — Sensitive File Access · unlock with TL Creds
  • BashOperator [indicator] Jinja2 Injection to subprocess bash -c (CVE-2026-30898) / [indicator] beforeCommands Shell Chain · unlock with TL Creds

Indicators of compromise for Flowise unpatched workflow RCE

As of 2026-11-01, Threadlinqs Intelligence tracks 28 indicators of compromise for TL-2026-2438.

Sample indicators (2 of 28)

  • File hash: 851aee543efa894142e0f7be03eb55d9cec06a91
  • File hash: 202e2b8efe44ba90adbf1087f6f70881ff947604

Defanged, TLP:CLEAR. Full set of 28 indicators: unlock with TL Creds.

28 indicators of compromise · unlock with TL Creds. Compare plans

How Flowise unpatched workflow RCE works

At DEF CON 34 (2026-08-06 to 2026-08-09) and in a subsequent Endor Labs writeup published 2026-08-18 ("Hacking Your Life with AI Can Get You Hacked"), researcher Peyton Kennedy detailed 14 critical/high-severity findings across NocoBase, Flowise, Langflow, Dify, Activepieces, Kestra, and Apache Airflow, framed under a single root-cause thesis: these AI orchestration platforms inherited the permissive single-user threat model of developer tools even though they are deployed as multi-tenant, internet-facing services that execute arbitrary code on behalf of untrusted users.

On NocoBase, the checkSQL() validation function that gates collections:create and sqlCollection:execute was never wired into sqlCollection:update, letting a user with ordinary collection-management permissions plant a benign SQL collection and then update it with attacker SQL (CVE-2026-41641). A second, independent flaw in queryParentSQL() built recursive CTE queries via raw string concatenation of node IDs instead of parameterized queries (CVE-2026-41640). Both were reachable up to and fixed in v2.0.39, and the escalation path runs through PostgreSQL's COPY ... TO PROGRAM to reach OS command execution. A separate, still-unpublished NocoBase advisory (GHSA-42wx-r3jw-6c5h) describes a Secure ECMAScript (SES) compartment escape caused by a disabled lockdown() call (left as a TODO) combined with a proxy guard that mis-handles TypeScript private fields.

Flowise's validator for LLM-generated Python running inside its Pyodide sandbox had at least six independent regex bypasses (GHSA-w7x8-q2gp-5cgg / CVE-2026-73487, CVSS 9.3): a \b import \b word-boundary check that does not match importlib, unblocked pandas URL-fetchers (pd.read_csv/pd.read_json) enabling SSRF, chr()-based runtime string construction, and uncovered numpy.ctypeslib calls. The full chain requires no authentication and no account -- a single request to /api/v1/prediction/<chatflow-uuid> is enough to make the LLM emit obfuscated Python, exfiltrate loaded CSV/Airtable datasets via query string, and pivot into the host Node process via process.mainModule.require('child_process'). Flowise (npm flowise and flowise-components, <=3.1.2) patched in 3.1.3, but the upstream FlowiseAI/Flowise repository was archived on 2026-08-13, so any future bypasses of the same validator class are permanently unfixed upstream.

Langflow's Smart Transform (LambdaFilterComponent) uses an LLM to synthesize a Python lambda from a chat instruction, then reduced its safety check to "starts with lambda and contains a colon" before calling eval() directly -- a syntactic shape check promoted to a security boundary (GHSA-9fpm-3445-2vx4 / CVSS 8.8, affecting >=1.3.0 <1.10.3, fixed 1.10.3/1.11.0). A single chat message containing lambda x: __import__('os').system('id') achieves code execution with no API access or code editor required. Two further Langflow findings -- an exec()-based RCE on POST /api/v1/custom_component (GHSA-8xrc-2jr4-78j7) and an MCP server-config command injection reaching bash -c (GHSA-w794-rj3p-xv45) -- are both rated Critical but their advisories are not yet public.

Dify's sandbox (dify-sandbox 0.2.15) executes a server-supplied {{preload}} string before lib.DifySeccomp() is ever called, so every sandbox control (chroot, no-new-privs, seccomp, uid drop) is applied after attacker code has already run as root; Kennedy confirmed euid=0, NoNewPrivs:0, and a readable /etc/shadow during the preload phase. The vendor closed this as working-as-designed. Activepieces has the identical execution-ordering bug in its own sandbox: importFresh()'s top-level require() executes the compiled module body in the host Node process before .toString() ever reaches the V8 isolate, letting an authenticated Code-step author call require('child_process') outside the sandbox (GHSA-gr3h-c2j7-r52g / CVE-2026-73083, CVSS 7.6). A second Activepieces bug lets a Code step's *name* -- concatenated unsanitized into a bun build shell command -- inject arbitrary commands before any sandboxing occurs (GHSA-3pfv-m69p-5fv5 / CVE-2026-73081, CVSS 8.7). Both were fixed in Activepieces v0.80.0.

Kestra has two CVSS 9.8 command-injection findings that the vendor closed as intended: one via the interpreter property reaching ProcessBuilder directly, and one via beforeCommands, where a Pebble-rendered {{ trigger.body.command }} value is string-concatenated and handed to /bin/sh -c. Because Kestra's webhook trigger is unauthenticated by default, an external, unauthenticated curl to the webhook endpoint reaches this sink and can write files such as /tmp/pwned to the host -- despite Kestra's stated position that "only trusted users have permission to create/execute workflows," execution is not gated when webhook triggers exist. Finally, Apache Airflow's BashOperator renders bash_command through Jinja2 using dag_run.conf values at trigger time and then passes the result to subprocess.run(['bash','-c', ...]) (CVE-2026-30898, CVSS 8.8); the vulnerable pattern appeared three times in Airflow's own documentation (an unwarned getting-started example, a provider-docs caution block, and an operator docstring reading "DO NOT DO THIS"). Apache's 3.2.0 fix corrects the documentation only -- the underlying subprocess sink is unchanged, so every existing DAG using this pattern remains exploitable and requires manual auditing.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Defense Evasion

T1027 Obfuscated Files or Information

Exfiltration

T1041 Exfiltration Over C2 Channel

Execution

T1059.004 Unix Shell; T1059.006 Python; T1059.007 JavaScript

Discovery

T1082 System Information Discovery

Initial Access

T1190 Exploit Public-Facing Application

Credential Access

T1552.001 Credentials In Files

Privilege Escalation

T1611 Escape to Host

Remediation for Flowise unpatched workflow RCE

Patches

  • NocoBase v2.0.39 (CVE-2026-41641, CVE-2026-41640)
  • Flowise/flowise-components v3.1.3 (CVE-2026-73487) -- last release before the repository was archived
  • Langflow v1.10.3 / v1.11.0 (Smart Transform eval() bypass, GHSA-9fpm-3445-2vx4)
  • Activepieces v0.80.0 (CVE-2026-73083, CVE-2026-73081)
  • Apache Airflow v3.2.0 (CVE-2026-30898) -- documentation-only fix; the subprocess sink itself is unchanged

Immediate actions

  • Place reverse-proxy authentication in front of unauthenticated execution endpoints: Flowise /api/v1/prediction/<uuid>, Kestra /api/v1/executions/webhook/..., Airflow /api/v2/dags/{id}/dagRuns
  • Disable or override dangerous defaults: unset LANGFLOW_SKIP_AUTH_AUTO_LOGIN (Langflow), disable SANDBOX_ENABLE_NETWORK and enable_preload (Dify)
  • Override the default dify-sandbox API key and remove network access from the sandbox container
  • Treat every webhook trigger endpoint (Kestra, n8n-style automation platforms) as an exposed, unauthenticated SSH port and firewall it accordingly
  • Audit all existing Airflow DAGs that pass dag_run.conf into BashOperator's bash_command and remove unsanitized Jinja2 interpolation

Workarounds

  • Dify: manually disable preload execution and enforce seccomp/chroot/uid-drop ordering at the deployment layer since the vendor will not change execution order
  • Kestra: disable or authenticate webhook triggers and restrict beforeCommands/interpreter usage to trusted flow authors only, since the vendor closed both findings as intended
  • Langflow: remove the Smart Transform (LambdaFilterComponent) from flows, or restrict flow access to trusted users, until custom_component and MCP config findings are also patched

Longer-term hardening

  • Upgrade NocoBase to >=2.0.39, Langflow to >=1.10.3/1.11.0, Activepieces to >=0.80.0, and Flowise to >=3.1.3 where a fix exists
  • Migrate away from Flowise: the upstream repository is archived (2026-08-13) and CVE-2026-73487-class validator bypasses will not receive further fixes
  • Redesign sandbox execution ordering so isolation (seccomp, V8 isolate, chroot, uid drop) is applied before any user- or LLM-supplied module code executes, not after
  • Treat multi-tenant AI orchestration deployments as requiring the same trust boundaries as multi-tenant SaaS, not single-user developer tooling
  • Never treat LLM-generated code (lambda expressions, Python, shell) as safe to eval()/exec() without a real sandbox and allow-listed builtins

Affected and fixed versions

  • NocoBase — NocoBase
    Vulnerable versions: < 2.0.39
    Fixed in: 2.0.39
  • FlowiseAI — Flowise / flowise-components (npm)
    Vulnerable versions: <= 3.1.2
    Fixed in: 3.1.3 (repository archived 2026-08-13, no further fixes)
  • Langflow — Langflow (Smart Transform / LambdaFilterComponent)
    Vulnerable versions: >=1.3.0, <1.10.3
    Fixed in: 1.10.3; 1.11.0
  • Langgenius — dify-sandbox
    Vulnerable versions: 0.2.15 (confirmed); execution-order flaw not version-scoped
    Fixed in: none -- closed as working-as-designed
  • Activepieces — Activepieces
    Vulnerable versions: < 0.80.0
    Fixed in: 0.80.0
  • Kestra — Kestra (interpreter property / beforeCommands + default webhook trigger)
    Vulnerable versions: all versions with default webhook trigger configuration
    Fixed in: none -- closed as intended
  • Apache Software Foundation — Apache Airflow (BashOperator)
    Vulnerable versions: all versions before 3.2.0 (docs); subprocess sink unpatched in all versions
    Fixed in: 3.2.0 (documentation only)

Timeline of Flowise unpatched workflow RCE

Last updated · revalidated 1× · latest source

  • Third-party advisory for CVE-2026-30898 published on the oss-security mailing list, detailing the Apache Airflow BashOperator locked-ioc-18 injection.
  • CVE-2026-30898 published in NVD; Apache Airflow ships a documentation-only fix (v3.2.0) while the BashOperator subprocess sink remains unchanged.
  • locked-ioc-23 publishes GHSA-wrwh-c28m-9jjh and GHSA-4948-f92q-f432 (CVE-2026-41641, CVE-2026-41640) for locked-ioc-9 and queryParentSQL() SQL injection, and ships fixed release v2.0.39.
  • locked-ioc-25 publishes GHSA-w7x8-q2gp-5cgg (CVE-2026-73487, CVSS 9.3) for unauthenticated prompt-injection-to-RCE/SSRF via the CSV/Airtable Agent Python validator bypass; patched in v3.1.3.
  • locked-ioc-24 publishes GHSA-9fpm-3445-2vx4 (CVSS 8.8) for the Smart Transform eval() lambda-validator bypass; patched in v1.10.3/v1.11.0.
  • locked-ioc-21 researcher locked-ioc-14 presents the cross-platform AI orchestration findings at DEF CON 34, Las Vegas (2026-08-06 to 2026-08-09).
  • locked-ioc-17 publishes GHSA-gr3h-c2j7-r52g (CVE-2026-73083, V8 isolate bypass) and GHSA-3pfv-m69p-5fv5 (CVE-2026-73081, Code-step command injection); both fixed in v0.80.0.
  • The FlowiseAI/locked-ioc-25 GitHub repository is archived, halting development and leaving all disclosed and future validator-bypass issues permanently unpatched upstream.
  • locked-ioc-21 publishes "Hacking Your Life with AI Can Get You Hacked," consolidating all 14 findings across the seven platforms under a shared multi-tenant threat-model thesis.
  • locked-ioc-21 updates its research report; patch status noted for locked-ioc-23 2.0.39, locked-ioc-24 1.10.3/1.11.0, locked-ioc-17 0.80.0 and Airflow 3.2.0 (documentation-only fix).
  • tldr sec newsletter (issue #345) surfaces the locked-ioc-21 disclosure to a broader security-practitioner audience.

Update history

Sources cited for Flowise unpatched workflow RCE

Showing 15 of 16 sources, primary sources first.

Drafted by the Threadlinqs research pipeline from 16 sources; published ; last updated .

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats