Langflow ToolGuard Validation Bypass Leading to Server-Side Code Execution

Technical Analysis

The ToolGuard integration only validates the main component's node_template['code']['value'] field, but does not validate dynamic CodeInput fields that store auto-generated ToolGuard Python wrapper code, which is persisted in Flow.data and executed server-side whenever a guarded tool is invoked. This lets an attacker with flow-creation privileges embed malicious Python in the unvalidated dynamic field, bypassing the allow_custom_components=false control entirely. The blast radius is expanded via the agentic MCP tool update_flow_component_field, which accepts a user_id parameter without proper authorization scoping, letting an attacker overwrite or poison flows belonging to other tenants/victims. Combined with AUTO_LOGIN=true and NEW_USER_IS_ACTIVE=true misconfigurations, an attacker may achieve this with minimal or default credentials, turning a single-tenant privilege into full multi-tenant remote code execution.

Affected Systems

IBM Langflow; protocols: MCP

Detection Signatures

• Unexpected writes to Flow.data CodeInput fields containing exec(), eval(), os.system, subprocess, or base64-encoded payloads
• MCP update_flow_component_field calls with user_id parameters not matching the authenticated caller's identity
• ToolGuard-generated code files with content diverging from expected wrapper templates
• Flow modification events originating from non-owner accounts or public/shared flows
• Spikes in flow creation/edit activity correlated with AUTO_LOGIN or default-active new accounts

Remediation Steps

1. 1

   Patch Langflow

   Upgrade to a fixed Langflow release once available that validates all dynamic CodeInput/ToolGuard-generated fields, not just the primary component code field.

2. 2

   Restrict MCP update_flow_component_field

   Enforce server-side authorization checks so user_id parameters cannot be spoofed; scope updates strictly to the authenticated caller's own flows/tenant.

3. 3

   Disable risky configurations

   Set AUTO_LOGIN=false and NEW_USER_IS_ACTIVE=false in production deployments to prevent reduced-authentication exploitation paths.

4. 4

   Audit stored flows

   Scan existing Flow.data records for injected ToolGuard code anomalies or unauthorized modifications, especially on publicly accessible flows.

5. 5

   Sandbox tool execution

   Run guarded tool execution in an isolated, least-privilege sandbox/container to limit impact of any code that bypasses validation.