# Endor Labs Discloses 14 Critical/High Vulnerabilities Across Seven AI Orchestration Platforms (NocoBase, Flowise, Langflow, Dify, Activepieces, Kestra, Apache Airflow)

> Endor Labs researcher Peyton Kennedy disclosed 14 critical/high vulnerabilities across seven AI agent/workflow orchestration platforms that treat multi-tenant, code-executing environments as single-user developer tools. Flowise, Kestra, and Langflow are exploitable pre-authentication via prompt injection leading to remote code execution, and Flowise's repository was archived on 2026-08-13, leaving its flaws permanently unpatched.

- **Published:** 2026-09-10T00:00:00Z
- **Last reviewed:** 2026-09-10T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2438
- **ID:** TL-2026-2438
- **Severity:** CRITICAL (CVSS 9.3)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 15 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-41641, CVE-2026-41640, CVE-2026-73083, CVE-2026-73081, CVE-2026-30898, CVE-2026-73487

## Description

At DEF CON 34 (2026-08-06 to 2026-08-09) and in a subsequent Endor Labs writeup published 2026-08-18 ("Hacking Your Life with AI Can Get You Hacked"), researcher Peyton Kennedy detailed 14 critical/high-severity findings across NocoBase, Flowise, Langflow, Dify, Activepieces, Kestra, and Apache Airflow, framed under a single root-cause thesis: these AI orchestration platforms inherited the permissive single-user threat model of developer tools even though they are deployed as multi-tenant, internet-facing services that execute arbitrary code on behalf of untrusted users.

On NocoBase, the checkSQL() validation function that gates collections:create and sqlCollection:execute was never wired into sqlCollection:update, letting a user with ordinary collection-management permissions plant a benign SQL collection and then update it with attacker SQL (CVE-2026-41641). A second, independent flaw in queryParentSQL() built recursive CTE queries via raw string concatenation of node IDs instead of parameterized queries (CVE-2026-41640). Both were reachable up to and fixed in v2.0.39, and the escalation path runs through PostgreSQL's COPY ... TO PROGRAM to reach OS command execution. A separate, still-unpublished NocoBase advisory (GHSA-42wx-r3jw-6c5h) describes a Secure ECMAScript (SES) compartment escape caused by a disabled lockdown() call (left as a TODO) combined with a proxy guard that mis-handles TypeScript private fields.

Flowise's validator for LLM-generated Python running inside its Pyodide sandbox had at least six independent regex bypasses (GHSA-w7x8-q2gp-5cgg / CVE-2026-73487, CVSS 9.3): a \b import \b word-boundary check that does not match importlib, unblocked pandas URL-fetchers (pd.read_csv/pd.read_json) enabling SSRF, chr()-based runtime string construction, and uncovered numpy.ctypeslib calls. The full chain requires no authentication and no account -- a single request to /api/v1/prediction/<chatflow-uuid> is enough to make the LLM emit obfuscated Python, exfiltrate loaded CSV/Airtable datasets via query string, and pivot into the host Node process via process.mainModule.require('child_process'). Flowise (npm flowise and flowise-components, <=3.1.2) patched in 3.1.3, but the upstream FlowiseAI/Flowise repository was archived on 2026-08-13, so any future bypasses of the same validator class are permanently unfixed upstream.

Langflow's Smart Transform (LambdaFilterComponent) uses an LLM to synthesize a Python lambda from a chat instruction, then reduced its safety check to "starts with lambda and contains a colon" before calling eval() directly -- a syntactic shape check promoted to a security boundary (GHSA-9fpm-3445-2vx4 / CVSS 8.8, affecting >=1.3.0 <1.10.3, fixed 1.10.3/1.11.0). A single chat message containing lambda x: __import__('os').system('id') achieves code execution with no API access or code editor required. Two further Langflow findings -- an exec()-based RCE on POST /api/v1/custom_component (GHSA-8xrc-2jr4-78j7) and an MCP server-config command injection reaching bash -c (GHSA-w794-rj3p-xv45) -- are both rated Critical but their advisories are not yet public.

Dify's sandbox (dify-sandbox 0.2.15) executes a server-supplied {{preload}} string before lib.DifySeccomp() is ever called, so every sandbox control (chroot, no-new-privs, seccomp, uid drop) is applied after attacker code has already run as root; Kennedy confirmed euid=0, NoNewPrivs:0, and a readable /etc/shadow during the preload phase. The vendor closed this as working-as-designed. Activepieces has the identical execution-ordering bug in its own sandbox: importFresh()'s top-level require() executes the compiled module body in the host Node process before .toString() ever reaches the V8 isolate, letting an authenticated Code-step author call require('child_process') outside the sandbox (GHSA-gr3h-c2j7-r52g / CVE-2026-73083, CVSS 7.6). A second Activepieces bug lets a Code step's *name* -- concatenated unsanitized into a bun build shell command -- inject arbitrary commands before any sandboxing occurs (GHSA-3pfv-m69p-5fv5 / CVE-2026-73081, CVSS 8.7). Both were fixed in Activepieces v0.80.0.

Kestra has two CVSS 9.8 command-injection findings that the vendor closed as intended: one via the interpreter property reaching ProcessBuilder directly, and one via beforeCommands, where a Pebble-rendered {{ trigger.body.command }} value is string-concatenated and handed to /bin/sh -c. Because Kestra's webhook trigger is unauthenticated by default, an external, unauthenticated curl to the webhook endpoint reaches this sink and can write files such as /tmp/pwned to the host -- despite Kestra's stated position that "only trusted users have permission to create/execute workflows," execution is not gated when webhook triggers exist. Finally, Apache Airflow's BashOperator renders bash_command through Jinja2 using dag_run.conf values at trigger time and then passes the result to subprocess.run(['bash','-c', ...]) (CVE-2026-30898, CVSS 8.8); the vulnerable pattern appeared three times in Airflow's own documentation (an unwarned getting-started example, a provider-docs caution block, and an operator docstring reading "DO NOT DO THIS"). Apache's 3.2.0 fix corrects the documentation only -- the underlying subprocess sink is unchanged, so every existing DAG using this pattern remains exploitable and requires manual auditing.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059.004 Unix Shell
- T1059.006 Python
- T1059.007 JavaScript
- T1611 Escape to Host
- T1027 Obfuscated Files or Information
- T1552.001 Credentials In Files
- T1082 System Information Discovery
- T1005 Data from Local System

## Sources

- [Hacking Your Life with AI Can Get You Hacked](https://www.endorlabs.com/learn/hacking-your-life-with-ai-can-get-you-hacked)
- [tldr sec #345](https://tldrsec.com/p/tldr-sec-345)
- [NVD - CVE-2026-41641](https://nvd.nist.gov/vuln/detail/CVE-2026-41641)
- [NVD - CVE-2026-41640](https://nvd.nist.gov/vuln/detail/CVE-2026-41640)
- [NVD - CVE-2026-73083](https://nvd.nist.gov/vuln/detail/CVE-2026-73083)
- [NVD - CVE-2026-73081](https://nvd.nist.gov/vuln/detail/CVE-2026-73081)
- [NVD - CVE-2026-30898](https://nvd.nist.gov/vuln/detail/CVE-2026-30898)
- [NocoBase GHSA-wrwh-c28m-9jjh (CVE-2026-41641)](https://github.com/nocobase/nocobase/security/advisories/GHSA-wrwh-c28m-9jjh)
- [NocoBase GHSA-4948-f92q-f432 (CVE-2026-41640)](https://github.com/nocobase/nocobase/security/advisories/GHSA-4948-f92q-f432)
- [Activepieces GHSA-gr3h-c2j7-r52g (CVE-2026-73083)](https://github.com/activepieces/activepieces/security/advisories/GHSA-gr3h-c2j7-r52g)
- [Activepieces GHSA-3pfv-m69p-5fv5 (CVE-2026-73081)](https://github.com/activepieces/activepieces/security/advisories/GHSA-3pfv-m69p-5fv5)
- [Langflow GHSA-9fpm-3445-2vx4 (Smart Transform eval() RCE)](https://github.com/langflow-ai/langflow/security/advisories/GHSA-9fpm-3445-2vx4)
- [Flowise GHSA-w7x8-q2gp-5cgg (CVE-2026-73487)](https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-w7x8-q2gp-5cgg)
- [Apache Airflow security advisory mailing list thread (CVE-2026-30898)](https://lists.apache.org/thread/26zmhfj1t95c1hld2r14ho81nzh1bdc8)
- [oss-security: Apache Airflow BashOperator dag_run.conf advisory](http://www.openwall.com/lists/oss-security/2026/04/17/7)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2438