Langflow RCE

MetasploitMetasploit exploitExploitRubyexploit_multi/http/langflow_rce_cve_2026_27966

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Metasploit
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Metasploit module that exploits CVE-2026-27966 in Langflow by uploading a malicious flow definition containing a CSV Agent node. The flow triggers LangChain's Python REPL to execute attacker-supplied Python or OS commands, achieving remote code execution.

Backdoor review

No backdoor observed in reviewed code

The reviewed Metasploit module source code implements a standard exploit for CVE-2026-27966. It uses the documented Langflow API to create a project, upload a CSV file, import a crafted flow, and trigger execution. The payload is delivered via the expected exploit mechanism (Python REPL injection) and no concealed backdoor, credential theft, persistence, or unrelated payload delivery is present.

ClassificationExploit
Model confidence100%
AuthenticationRequired
Languagesruby
Target softwarelangflow
Attack typesremote code executionprompt injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The module is a complete Metasploit exploit that actively exercises the vulnerability by constructing and sending HTTP requests to create a project, upload a CSV file, import a malicious flow, and trigger execution of attacker-controlled commands on the target server. It includes payload encoding and delivery, not just detection.

modules/exploits/multi/http/langflow_rce_cve_2026_27966.rb:6modules/exploits/multi/http/langflow_rce_cve_2026_27966.rb:103-185

Requirements

  • Valid Langflow API keymodules/exploits/multi/http/langflow_rce_cve_2026_27966.rb:68
  • Attacker-controlled Ollama API endpointmodules/exploits/multi/http/langflow_rce_cve_2026_27966.rb:69
  • Valid Ollama model namemodules/exploits/multi/http/langflow_rce_cve_2026_27966.rb:70
  • Target Langflow version < 1.8.0modules/exploits/multi/http/langflow_rce_cve_2026_27966.rb:88

Observed behavior

  • Checks target version via /api/v1/version and validates API key via /api/v1/users/whoamimodules/exploits/multi/http/langflow_rce_cve_2026_27966.rb:76-101
  • Creates a new project via POST /api/v1/projects/modules/exploits/multi/http/langflow_rce_cve_2026_27966.rb:104-120
  • Uploads a CSV file via POST /api/v2/filesmodules/exploits/multi/http/langflow_rce_cve_2026_27966.rb:122-137
  • Loads and customizes a JSON exploit template (cve_2026_27966.json) with project ID, model, Ollama URI, file path, and payloadmodules/exploits/multi/http/langflow_rce_cve_2026_27966.rb:139-151
  • Imports the malicious flow via POST /api/v1/flows/upload/modules/exploits/multi/http/langflow_rce_cve_2026_27966.rb:157-170
  • Triggers flow execution via POST /api/v1/build/{flow_id}/flow, causing payload execution on the servermodules/exploits/multi/http/langflow_rce_cve_2026_27966.rb:173-185
  • Cleans up by deleting the uploaded file and projectmodules/exploits/multi/http/langflow_rce_cve_2026_27966.rb:187-207
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Mechanism
The module constructs a flow JSON from an external data file (exploit_data) and substitutes attacker-controlled values (folder ID, model name, Ollama API URI, file path, payload) before uploading and executing it.This is the intended exploit path for CVE-2026-27966; no hidden or unrelated behavior is observed.modules/exploits/multi/http/langflow_rce_cve_2026_27966.rb:139-185
Payload Delivery
For non-Python targets, the payload is base64-encoded and passed to a shell via os.system. For Python targets, the raw payload is substituted directly.This is standard Metasploit payload handling; no additional commands or backdoors are injected.modules/exploits/multi/http/langflow_rce_cve_2026_27966.rb:144-150
Cleanup Behavior
The cleanup method deletes the uploaded file and project using the same API key.This is benign housekeeping; no persistence or malicious artifact retention.modules/exploits/multi/http/langflow_rce_cve_2026_27966.rb:187-207
Review boundaries

What the analysis did not establish

  • The exploit data template file (cve_2026_27966.json) referenced at line 139 is not included in the evidence; its exact content is unknown.
  • Metasploit framework mixins (HttpClient, AutoCheck, Post::File) and payload modules are not expanded; their behavior is assumed from standard Metasploit conventions.
  • The evidence does not include runtime execution output or confirmation that the exploit succeeds.
  • The external exploit data file 'cve_2026_27966.json' referenced on line 139 is not included in the evidence; its contents are not reviewed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1