IBM Langflow AsyncDiskCache Insecure Deserialization RCE

Technical Analysis

The AsyncDiskCache class reads objects from disk and passes them directly to pickle.loads(), which will execute arbitrary code embedded in a crafted pickle stream during deserialization. Entry points include any workflow, component, or API path that lets an attacker write or influence files that later get cached and reloaded by the agent runtime, meaning no direct filesystem access is strictly required if cache poisoning can be achieved through the application's normal input surfaces. Successful exploitation gives the attacker code execution in the context of the Langflow server process, effectively compromising the entire agent orchestration layer, its credentials, connected tools, and any downstream systems it can reach. This crosses a trust boundary because cache data, which should be treated as untrusted once external inputs can influence it, is implicitly trusted and executed as code rather than treated as inert data.

Affected Systems

IBM Langflow OSS (1.0.0 through 1.10.0)

Detection Signatures

• Unexpected child processes spawned by the Langflow server process
• Anomalous file writes to Langflow's disk cache directory from unexpected sources
• Log entries showing AsyncDiskCache invocation immediately followed by unusual outbound network connections or process spawns
• Presence of non-standard or unusually large binary blobs in cache files inconsistent with expected serialized Python objects
• Workflow or component inputs containing embedded pickle opcodes (e.g., GLOBAL, REDUCE opcodes) or suspicious base64/binary payload strings

Remediation Steps

1. 1

   Upgrade Langflow

   Apply the vendor patch or upgrade to a Langflow release beyond 1.10.0 that removes or secures the pickle-based caching mechanism.

2. 2

   Replace pickle with safe serialization

   Where custom deployments are used, replace pickle.loads() with a safe serialization format such as JSON or a schema-validated structure, and avoid deserializing untrusted binary data as executable objects.

3. 3

   Restrict cache write access

   Ensure the disk cache directory is not writable by untrusted users, workflows, or external API callers; enforce strict filesystem permissions and isolate the cache from user-controlled inputs.

4. 4

   Sandbox the Langflow server process

   Run Langflow under least-privilege service accounts, in containers or sandboxes with restricted network and filesystem access, to limit blast radius if RCE occurs.

5. 5

   Add integrity verification

   Introduce HMAC or digital signature verification on cached objects before deserialization to detect tampering.

6. 6

   Monitor and alert

   Deploy runtime monitoring for anomalous process creation, unexpected network egress, and cache directory modifications tied to the Langflow service.