Endor Labs Discloses 14 Critical/High Vulnerabilities Across Seven AI Orchestration Platforms (NocoBase, Flowise, Langflow, Dify, Activepieces, Kestra, Apache Airflow)

Endor Labs Discloses 14 Critical/High Vulnerabilities Across (TL-2026-2438) is a critical-severity software vulnerability scored CVSS 9.3, first published 2026-09-10. It has no confirmed attribution, affects NocoBase NocoBase, references 6 CVEs (CVE-2026-41641, CVE-2026-41640, CVE-2026-73083), maps to 9 MITRE ATT&CK techniques (T1005, T1027, T1059.004), and is covered by 9 detection rules and 15 indicators of compromise.

Key facts for TL-2026-2438

Threat ID
TL-2026-2438
Severity
CRITICAL
CVSS
9.3
Status
ACTIVE
Category
VULNERABILITY
First published
2026-09-10
Last reviewed
2026-09-10
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
technology, softwaredevelopment, cross-sector
Target regions
Global
Detection rules
9
Indicators of compromise
15

Endor Labs researcher Peyton Kennedy disclosed 14 critical/high vulnerabilities across seven AI agent/workflow orchestration platforms that treat multi-tenant, code-executing environments as single-user developer tools. Flowise, Kestra, and Langflow are exploitable pre-authentication via prompt injection leading to remote code execution, and Flowise's repository was archived on 2026-08-13, leaving its flaws permanently unpatched.

How Endor Labs Discloses 14 Critical/High Vulnerabilities Across works

At DEF CON 34 (2026-08-06 to 2026-08-09) and in a subsequent Endor Labs writeup published 2026-08-18 ("Hacking Your Life with AI Can Get You Hacked"), researcher Peyton Kennedy detailed 14 critical/high-severity findings across NocoBase, Flowise, Langflow, Dify, Activepieces, Kestra, and Apache Airflow, framed under a single root-cause thesis: these AI orchestration platforms inherited the permissive single-user threat model of developer tools even though they are deployed as multi-tenant, internet-facing services that execute arbitrary code on behalf of untrusted users.

On NocoBase, the checkSQL() validation function that gates collections:create and sqlCollection:execute was never wired into sqlCollection:update, letting a user with ordinary collection-management permissions plant a benign SQL collection and then update it with attacker SQL (CVE-2026-41641). A second, independent flaw in queryParentSQL() built recursive CTE queries via raw string concatenation of node IDs instead of parameterized queries (CVE-2026-41640). Both were reachable up to and fixed in v2.0.39, and the escalation path runs through PostgreSQL's COPY ... TO PROGRAM to reach OS command execution. A separate, still-unpublished NocoBase advisory (GHSA-42wx-r3jw-6c5h) describes a Secure ECMAScript (SES) compartment escape caused by a disabled lockdown() call (left as a TODO) combined with a proxy guard that mis-handles TypeScript private fields.

Flowise's validator for LLM-generated Python running inside its Pyodide sandbox had at least six independent regex bypasses (GHSA-w7x8-q2gp-5cgg / CVE-2026-73487, CVSS 9.3): a \b import \b word-boundary check that does not match importlib, unblocked pandas URL-fetchers (pd.read_csv/pd.read_json) enabling SSRF, chr()-based runtime string construction, and uncovered numpy.ctypeslib calls. The full chain requires no authentication and no account -- a single request to /api/v1/prediction/<chatflow-uuid> is enough to make the LLM emit obfuscated Python, exfiltrate loaded CSV/Airtable datasets via query string, and pivot into the host Node process via process.mainModule.require('child_process'). Flowise (npm flowise and flowise-components, <=3.1.2) patched in 3.1.3, but the upstream FlowiseAI/Flowise repository was archived on 2026-08-13, so any future bypasses of the same validator class are permanently unfixed upstream.

Langflow's Smart Transform (LambdaFilterComponent) uses an LLM to synthesize a Python lambda from a chat instruction, then reduced its safety check to "starts with lambda and contains a colon" before calling eval() directly -- a syntactic shape check promoted to a security boundary (GHSA-9fpm-3445-2vx4 / CVSS 8.8, affecting >=1.3.0 <1.10.3, fixed 1.10.3/1.11.0). A single chat message containing lambda x: __import__('os').system('id') achieves code execution with no API access or code editor required. Two further Langflow findings -- an exec()-based RCE on POST /api/v1/custom_component (GHSA-8xrc-2jr4-78j7) and an MCP server-config command injection reaching bash -c (GHSA-w794-rj3p-xv45) -- are both rated Critical but their advisories are not yet public.

Dify's sandbox (dify-sandbox 0.2.15) executes a server-supplied {{preload}} string before lib.DifySeccomp() is ever called, so every sandbox control (chroot, no-new-privs, seccomp, uid drop) is applied after attacker code has already run as root; Kennedy confirmed euid=0, NoNewPrivs:0, and a readable /etc/shadow during the preload phase. The vendor closed this as working-as-designed. Activepieces has the identical execution-ordering bug in its own sandbox: importFresh()'s top-level require() executes the compiled module body in the host Node process before .toString() ever reaches the V8 isolate, letting an authenticated Code-step author call require('child_process') outside the sandbox (GHSA-gr3h-c2j7-r52g / CVE-2026-73083, CVSS 7.6). A second Activepieces bug lets a Code step's *name* -- concatenated unsanitized into a bun build shell command -- inject arbitrary commands before any sandboxing occurs (GHSA-3pfv-m69p-5fv5 / CVE-2026-73081, CVSS 8.7). Both were fixed in Activepieces v0.80.0.

Kestra has two CVSS 9.8 command-injection findings that the vendor closed as intended: one via the interpreter property reaching ProcessBuilder directly, and one via beforeCommands, where a Pebble-rendered {{ trigger.body.command }} value is string-concatenated and handed to /bin/sh -c. Because Kestra's webhook trigger is unauthenticated by default, an external, unauthenticated curl to the webhook endpoint reaches this sink and can write files such as /tmp/pwned to the host -- despite Kestra's stated position that "only trusted users have permission to create/execute workflows," execution is not gated when webhook triggers exist. Finally, Apache Airflow's BashOperator renders bash_command through Jinja2 using dag_run.conf values at trigger time and then passes the result to subprocess.run(['bash','-c', ...]) (CVE-2026-30898, CVSS 8.8); the vulnerable pattern appeared three times in Airflow's own documentation (an unwarned getting-started example, a provider-docs caution block, and an operator docstring reading "DO NOT DO THIS"). Apache's 3.2.0 fix corrects the documentation only -- the underlying subprocess sink is unchanged, so every existing DAG using this pattern remains exploitable and requires manual auditing.

MITRE ATT&CK techniques used in TL-2026-2438

Collection

T1005 Data from Local System

Defense Evasion

T1027 Obfuscated Files or Information

Execution

T1059.004 Unix Shell; T1059.006 Python; T1059.007 JavaScript

Discovery

T1082 System Information Discovery

Initial Access

T1190 Exploit Public-Facing Application

Credential Access

T1552.001 Credentials In Files

Privilege Escalation

T1611 Escape to Host

Affected products and versions in Endor Labs Discloses 14 Critical/High Vulnerabilities Across

  • NocoBase — NocoBase
    Vulnerable versions: < 2.0.39
    Fixed in: 2.0.39
  • FlowiseAI — Flowise / flowise-components (npm)
    Vulnerable versions: <= 3.1.2
    Fixed in: 3.1.3 (repository archived 2026-08-13, no further fixes)
  • Langflow — Langflow (Smart Transform / LambdaFilterComponent)
    Vulnerable versions: >=1.3.0, <1.10.3
    Fixed in: 1.10.3; 1.11.0
  • Langgenius — dify-sandbox
    Vulnerable versions: 0.2.15 (confirmed); execution-order flaw not version-scoped
    Fixed in: none -- closed as working-as-designed
  • Activepieces — Activepieces
    Vulnerable versions: < 0.80.0
    Fixed in: 0.80.0
  • Kestra — Kestra (interpreter property / beforeCommands + default webhook trigger)
    Vulnerable versions: all versions with default webhook trigger configuration
    Fixed in: none -- closed as intended
  • Apache Software Foundation — Apache Airflow (BashOperator)
    Vulnerable versions: all versions before 3.2.0 (docs); subprocess sink unpatched in all versions
    Fixed in: 3.2.0 (documentation only)

Remediation for Endor Labs Discloses 14 Critical/High Vulnerabilities Across

Patches

  • NocoBase v2.0.39 (CVE-2026-41641, CVE-2026-41640)
  • Flowise/flowise-components v3.1.3 (CVE-2026-73487) -- last release before the repository was archived
  • Langflow v1.10.3 / v1.11.0 (Smart Transform eval() bypass, GHSA-9fpm-3445-2vx4)
  • Activepieces v0.80.0 (CVE-2026-73083, CVE-2026-73081)
  • Apache Airflow v3.2.0 (CVE-2026-30898) -- documentation-only fix; the subprocess sink itself is unchanged

Immediate actions

  • Place reverse-proxy authentication in front of unauthenticated execution endpoints: Flowise /api/v1/prediction/<uuid>, Kestra /api/v1/executions/webhook/..., Airflow /api/v2/dags/{id}/dagRuns
  • Disable or override dangerous defaults: unset LANGFLOW_SKIP_AUTH_AUTO_LOGIN (Langflow), disable SANDBOX_ENABLE_NETWORK and enable_preload (Dify)
  • Override the default dify-sandbox API key and remove network access from the sandbox container
  • Treat every webhook trigger endpoint (Kestra, n8n-style automation platforms) as an exposed, unauthenticated SSH port and firewall it accordingly
  • Audit all existing Airflow DAGs that pass dag_run.conf into BashOperator's bash_command and remove unsanitized Jinja2 interpolation

Workarounds

  • Dify: manually disable preload execution and enforce seccomp/chroot/uid-drop ordering at the deployment layer since the vendor will not change execution order
  • Kestra: disable or authenticate webhook triggers and restrict beforeCommands/interpreter usage to trusted flow authors only, since the vendor closed both findings as intended
  • Langflow: remove the Smart Transform (LambdaFilterComponent) from flows, or restrict flow access to trusted users, until custom_component and MCP config findings are also patched

Longer-term hardening

  • Upgrade NocoBase to >=2.0.39, Langflow to >=1.10.3/1.11.0, Activepieces to >=0.80.0, and Flowise to >=3.1.3 where a fix exists
  • Migrate away from Flowise: the upstream repository is archived (2026-08-13) and CVE-2026-73487-class validator bypasses will not receive further fixes
  • Redesign sandbox execution ordering so isolation (seccomp, V8 isolate, chroot, uid drop) is applied before any user- or LLM-supplied module code executes, not after
  • Treat multi-tenant AI orchestration deployments as requiring the same trust boundaries as multi-tenant SaaS, not single-user developer tooling
  • Never treat LLM-generated code (lambda expressions, Python, shell) as safe to eval()/exec() without a real sandbox and allow-listed builtins

CVEs associated with Endor Labs Discloses 14 Critical/High Vulnerabilities Across

CVE-2026-41641, CVE-2026-41640, CVE-2026-73083, CVE-2026-73081, CVE-2026-30898, CVE-2026-73487

Weaknesses (CWE) in Endor Labs Discloses 14 Critical/High Vulnerabilities Across

CWE-89, CWE-284, CWE-78, CWE-77, CWE-693, CWE-95

Timeline of Endor Labs Discloses 14 Critical/High Vulnerabilities Across

  • Third-party advisory for CVE-2026-30898 published on the oss-security mailing list, detailing the Apache Airflow BashOperator dag_run.conf injection.
  • CVE-2026-30898 published in NVD; Apache Airflow ships a documentation-only fix (v3.2.0) while the BashOperator subprocess sink remains unchanged.
  • NocoBase publishes GHSA-wrwh-c28m-9jjh and GHSA-4948-f92q-f432 (CVE-2026-41641, CVE-2026-41640) for sqlCollection:update and queryParentSQL() SQL injection, and ships fixed release v2.0.39.
  • Flowise publishes GHSA-w7x8-q2gp-5cgg (CVE-2026-73487, CVSS 9.3) for unauthenticated prompt-injection-to-RCE/SSRF via the CSV/Airtable Agent Python validator bypass; patched in v3.1.3.
  • Langflow publishes GHSA-9fpm-3445-2vx4 (CVSS 8.8) for the Smart Transform eval() lambda-validator bypass; patched in v1.10.3/v1.11.0.
  • Endor Labs researcher Peyton Kennedy presents the cross-platform AI orchestration findings at DEF CON 34, Las Vegas (2026-08-06 to 2026-08-09).
  • Activepieces publishes GHSA-gr3h-c2j7-r52g (CVE-2026-73083, V8 isolate bypass) and GHSA-3pfv-m69p-5fv5 (CVE-2026-73081, Code-step command injection); both fixed in v0.80.0.
  • The FlowiseAI/Flowise GitHub repository is archived, halting development and leaving all disclosed and future validator-bypass issues permanently unpatched upstream.
  • Endor Labs publishes "Hacking Your Life with AI Can Get You Hacked," consolidating all 14 findings across the seven platforms under a shared multi-tenant threat-model thesis.
  • tldr sec newsletter (issue #345) surfaces the Endor Labs disclosure to a broader security-practitioner audience.

Sources cited for Endor Labs Discloses 14 Critical/High Vulnerabilities Across

More in vulnerability

Detection coverage for TL-2026-2438

As of 2026-09-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2438 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats