feat: add Langflow CVE-2026-9198 detection module - #1660
Conversation
Signed-off-by: francesco <francesco.zaritto@gmail.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
👮 Files not reviewed due to content moderation or server errors (2)
Summary by CodeRabbit
WalkthroughAdds a Langflow CVE-2026-9198 vulnerability module. The module chains auto-login JWT retrieval with authenticated Python code execution over HTTP and HTTPS. It also updates Langflow vulnerability documentation. ChangesLangflow vulnerability detection
Estimated code review effort: 3 (Moderate) | ~25 minutes Mergeability Score: 🟡 Moderate · up to This PR adds the Langflow vulnerability detection module and updates its documentation, but required repository reviews are currently failing for both changed files. It is not merge-ready until those failures are resolved or explicitly accepted by the appropriate owners. Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Contribution validation failed:
|
|
Hi @securestep9, I'm sorry, I forgot to link the issue when I created the PR. It's been updated, and the pull request is ready for review. |
|
@Franc-Zar please add screenshots showing the module detecting the vulnerable version |
|
@codex review this PR using skill: https://github.com/nettacker-codex-ai/skills/blob/main/pr-review-recommender/SKILL.md |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 20022af661
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| - 7860 | ||
| - 80 |
There was a problem hiding this comment.
When a target answers on both candidate ports—for example, an unrelated service responds quickly on port 80 while vulnerable Langflow runs on 7860—the two concurrent auto-login requests save results under the same get_http_superuser_jwt event name. BaseEngine.process_conditions saves temporary events even when their conditions did not match, while find_temp_events selects one matching event without filtering by port, so the validation requests can receive Bearer error or a token minted by the other service and miss the vulnerability. Split the port flows into distinct dependency names so each validation request consumes the JWT from its corresponding auto-login request; the HTTPS 7860/443 flow has the same issue.
Useful? React with 👍 / 👎.
| @@ -0,0 +1,148 @@ | |||
| info: | |||
There was a problem hiding this comment.
The reviewed commit object has no gpgsig header, so despite the checked PR declaration it is an unsigned commit. Recreate the commit with a valid signature before merging, as this repository requires every commit to be signed.
AGENTS.md reference: AGENTS.md:L33-L35
Useful? React with 👍 / 👎.
| description: > | ||
| IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain | ||
| /api/v1/auto_login (mints SUPERUSER tokens to any network caller) with /api/v1/validate/code | ||
| (executes user code via exec()) to achieve full RCE on default Langflow deployments |
There was a problem hiding this comment.
The proposed change's reproduction instructions state that affected containers must be started with LANGFLOW_AUTO_LOGIN=true, but this description says the chain works on default deployments. Because this text is exposed as the module's CLI metadata, it overstates which installations are exposed; describe the vulnerable case as deployments with auto-login explicitly enabled.
Useful? React with 👍 / 👎.
| ssl: false | ||
| json: | ||
| code: | | ||
| def foo(rce=exec("raise Exception(__import__('subprocess').check_output(['id'], shell=True, stderr=__import__('subprocess').STDOUT).decode())")): |
There was a problem hiding this comment.
On vulnerable Langflow installations running natively on Windows or another environment without the Unix id utility, the injected Python executes but check_output(['id'], shell=True, ...) only raises a command-not-found error, which cannot satisfy the later uid=... response regex. This produces a false negative even though arbitrary Python execution succeeded; raise a fixed marker from Python itself and match that marker instead. The duplicated HTTPS payload has the same limitation.
Useful? React with 👍 / 👎.
|
Hi @securestep9, I have addressed the first round of review:
|
2 participants
Proposed change
This PR adds a new detection module for CVE-2026-9198, an RCE vulnerability affecting Langflow versions 1.0.0 through 1.10.0.
Tested against vulnerable and patched versions of the official langflowai/langflow Docker images.
Note: to reproduce vulnerability is mandatory to run affected versions containers with
-e LANGFLOW_AUTO_LOGIN=trueCloses #1656
Type of change
Checklist
make pre-commitand confirm it didn't generate any warnings/changesmake testand I confirm all tests passed locallydocs/folder