IBM Langflow A2A Public Endpoint Unauthenticated Remote Code Execution

Technical Analysis

The vulnerability resides in Langflow's A2A public endpoint, which is designed to facilitate inter-agent communication but lacks proper authentication or authorization checks before processing incoming requests. An attacker can send crafted requests to this exposed endpoint to trigger arbitrary code execution on the host system, likely by abusing deserialization, flow-execution, or component-loading logic that the A2A protocol handler exposes without validation. Because the endpoint is public-facing and the exploit requires no prior authentication, this crosses the boundary from inter-agent protocol trust into full host compromise, potentially allowing the attacker to pivot to other connected agents, tools, or backend infrastructure reachable from the compromised Langflow instance.

Affected Systems

IBM Langflow; protocols: A2A

Detection Signatures

• Unexpected inbound requests to Langflow A2A endpoint paths from untrusted/external IPs
• Spawned child processes or shell invocations originating from the Langflow server process
• Unusual outbound network connections initiated by the Langflow host shortly after A2A endpoint access
• Log entries showing A2A requests without corresponding valid authentication tokens
• Anomalous flow/component loading events not tied to known user sessions

Remediation Steps

1. 1

   Upgrade Langflow

   Update to a patched Langflow release beyond version 1.11.1 that enforces proper authentication and authorization on the A2A endpoint.

2. 2

   Restrict network exposure

   Do not expose the A2A endpoint directly to the public internet; place it behind a VPN, firewall, or authenticated reverse proxy.

3. 3

   Enforce authentication on A2A endpoints

   Ensure all A2A protocol handlers require valid credentials/tokens before processing requests, and audit for other unauthenticated endpoints.

4. 4

   Monitor and audit logs

   Enable detailed logging of A2A endpoint access and review for anomalous or unauthenticated requests indicative of exploitation attempts.

5. 5

   Apply least privilege

   Run Langflow services with minimal OS-level privileges to limit the blast radius of any successful code execution.