Langflow Public Flow Build Endpoint Unauthenticated RCE via Denylist Bypass

Technical Analysis

The vulnerability resides in the validate_public_flow_no_code_execution() function, which is intended to act as a denylist preventing code-execution-capable components from being invoked via the unauthenticated /api/v1/build_public_tmp/{flow_id}/flow endpoint. Because the denylist is incomplete, an attacker can submit or reference a flow definition containing OpenDsStarAgent, CodeActAgentSmolagents, or CSVAgent nodes, which execute arbitrary code (e.g., Python execution or shell-like operations) as part of normal agent tool functionality. Since the endpoint is public and requires no authentication, this crosses the trust boundary between untrusted external callers and the server's execution environment, effectively granting remote code execution on the Langflow host. The attacker gains full code execution in the context of the Langflow server process, which can lead to credential theft, lateral movement, data exfiltration, or further compromise of connected agent tools and downstream systems.

Affected Systems

Langflow OSS

Detection Signatures

• Requests to /api/v1/build_public_tmp/{flow_id}/flow endpoint from unauthenticated or unexpected source IPs
• Flow definitions referencing OpenDsStarAgent, CodeActAgentSmolagents, or CSVAgent components submitted via public build endpoints
• Unexpected spawning of subprocess/python execution from the Langflow server process following API calls
• Anomalous outbound network connections or file system access originating from Langflow worker processes shortly after flow build requests
• Log entries showing flow build requests without corresponding authenticated session tokens

Remediation Steps

1. 1

   Upgrade Langflow

   Update to a patched version of Langflow OSS beyond 1.10.1 once available, which fixes the denylist to properly block all code-execution-capable agent components.

2. 2

   Restrict or disable public flow endpoint

   Disable or restrict access to /api/v1/build_public_tmp/{flow_id}/flow via network controls, reverse proxy authentication, or firewall rules until patched.

3. 3

   Enforce authentication on all build endpoints

   Require authentication and authorization checks on any endpoint capable of triggering flow execution, rather than relying solely on component-level denylisting.

4. 4

   Sandbox agent execution

   Run Langflow agent execution components in isolated, least-privilege sandboxes/containers to limit blast radius if a code-execution component is invoked maliciously.

5. 5

   Audit and allowlist components

   Replace denylist-based validation with a strict allowlist of safe, non-code-execution components permitted for public/unauthenticated flows.

6. 6

   Monitor and alert

   Deploy monitoring for anomalous process execution, network egress, and file access tied to the Langflow service, and alert on public endpoint usage patterns.