CVE-2026-0768

GitHubCurated repository PoCExploitCexploitintel/eip-pocs-and-cves

PoC files

12 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact contains three independent Python exploit scripts (poc.py, poc_vector2.py, poc_vector3.py) that achieve unauthenticated remote code execution against Langflow by sending crafted HTTP POST requests to the /api/v1/validate/code endpoint. The scripts use different code injection techniques (default argument evaluation, generator throw, decorator evaluation) to execute arbitrary OS commands on the target server.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of documentation and three Python PoC scripts for CVE-2026-0768, a remote code execution vulnerability in Langflow. All scripts are clearly disclosed as exploit code targeting a remote Langflow instance via the /api/v1/validate/code endpoint. The code constructs and sends HTTP requests containing malicious Python payloads to achieve command execution on the target server. No local execution of hidden payloads, unauthorized data exfiltration to third parties, or concealed persistence mechanisms were found. The behavior is fully consistent with the stated purpose of demonstrating the CVE.

ClassificationExploit
Model confidence100%
AuthenticationNot required
Languagespython
Target softwarelangflow
Attack typescode injectionremote code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact includes three complete, functional Python scripts (poc.py, poc_vector2.py, poc_vector3.py) that construct and send malicious HTTP requests to execute arbitrary OS commands on a remote target. The scripts are explicitly designed to exploit the vulnerability, not merely detect it. The README and verification reports confirm the scripts were tested and successfully achieved remote code execution.

poc/poc.py:1-13poc/poc.py:176-221poc_verification_report.md:3-5poc_verification_report.md:220-228

Requirements

  • Network access to the target Langflow instance on the HTTP port (default 7860).poc/poc.py:53
  • The target must be running a vulnerable version of Langflow (<= 1.4.2) with the /api/v1/validate/code endpoint exposed without authentication.poc/poc.py:17-23

Observed behavior

  • Sends an HTTP POST request to /api/v1/validate/code with a JSON body containing a 'code' field that holds a Python function definition with a malicious default argument, decorator, or generator expression.poc/poc.py:96-101poc/poc_vector2.py:71-77poc/poc_vector3.py:84-89
  • The server's validate_code() function compiles and executes the user-supplied code with Python's exec(), causing the malicious expression to be evaluated immediately at function definition time.README.md:46-54
  • The exploit exfiltrates command output by raising an exception containing the result of a subprocess call, which is returned in the HTTP response body under function.errors[0].poc/poc.py:145-165
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Url
http://{target_host}:{target_port}/api/v1/validate/codeThe target endpoint for the exploit, as described in the CVE. All PoC scripts send crafted POST requests to this endpoint on a user-specified host and port.poc/poc.py:45poc/poc_vector2.py:41poc/poc_vector3.py:54
Command
python3 poc/poc.py localhost 17860 "id"Example usage command from the documentation, showing how an operator would run the PoC against a local test instance.README.md:133
Review boundaries

What the analysis did not establish

  • The evidence packet reports complete_artifact_coverage as false, indicating that not all files from the repository unit were included. However, all six selected text files are complete and sufficient for classification.
  • One non-text media file (interface-screenshot.png, 330810 bytes) was present but not analyzed per binary policy.
  • The review is limited to the six text files provided in the evidence packet. No binary files, Docker configurations, or other repository contents were inspected.
  • The analysis assumes the operator runs the PoC scripts locally against a target they control or have authorization to test, as stated in the documentation's disclaimer.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

1
GitHub

CVE-2026-0768/docker-compose.yml

Created Vuln labCVE-2026-0768Compose · mixed

1 Compose manifest · 1 Dockerfile · 1 service

Lab screenshot for CVE-2026-0768/docker-compose.yml
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A single-service Docker Compose lab running a vulnerable Langflow v1.1.1 instance with auto-login enabled, exposed on host port 17860. The lab is designed to demonstrate CVE-2026-0768, an unauthenticated remote code execution vulnerability in the /api/v1/validate/code endpoint.

CVE-2026-0768/docker-compose.yml:1-38CVE-2026-0768/Dockerfile.vulnerable:1CVE-2026-0768/README.md:1-282

Lab assessment

Vulnerability lab

The environment is explicitly a vulnerability lab. The README describes it as a 'Lab Setup' for CVE-2026-0768, the Dockerfile pins a known vulnerable version (v1.1.1), and the compose file configures the service with auto-login and a healthcheck. Three PoC scripts are provided to exploit the target.

CVE-2026-0768/README.md:1-3CVE-2026-0768/README.md:72-82CVE-2026-0768/Dockerfile.vulnerable:1
Lab shapeCompose · mixed
Services1
Compose manifests1
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

vulnerable

vulnerable targetLangflow web application

A containerized Langflow v1.1.1 instance built from the official image. It exposes the Langflow web service on port 7860 inside the container, mapped to host port 17860. The environment enables auto-login and disables telemetry. A healthcheck polls /health.

CVE-2026-0768/docker-compose.yml:8-30CVE-2026-0768/Dockerfile.vulnerable:1

poc.py

exploit scriptproof-of-concept

A Python 3 script that exploits CVE-2026-0768 by sending a crafted POST request to /api/v1/validate/code. It uses default argument evaluation to achieve RCE and exfiltrates command output via the API error response. It can run a single command or a multi-command demo suite.

CVE-2026-0768/poc/poc.py:1-287

poc_vector2.py

exploit scriptproof-of-concept

A Python 3 script that exploits the same vulnerability using a generator throw technique with subprocess.run() for cleaner text output. It sends a single HTTP POST request to the vulnerable endpoint.

CVE-2026-0768/poc/poc_vector2.py:1-155

poc_vector3.py

exploit scriptproof-of-concept

A Python 3 script that exploits the vulnerability via Python decorator syntax, demonstrating a distinct code path (decorator_list) that would bypass default-argument filtering. It sends a single HTTP POST request to the vulnerable endpoint.

CVE-2026-0768/poc/poc_vector3.py:1-198
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2026-0768

Supported by supplied evidence

The lab is explicitly named and documented for CVE-2026-0768. The README, PoC scripts, and verification report all describe the vulnerability as unauthenticated RCE via code injection in Langflow's /api/v1/validate/code endpoint, matching the CVE description. The Dockerfile pins the vulnerable version v1.1.1.

CVE-2026-0768/README.md:1-3CVE-2026-0768/README.md:10-14CVE-2026-0768/Dockerfile.vulnerable:1
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker with Docker Compose pluginCVE-2026-0768/README.md:72-73
  • Internet access to pull langflowai/langflow:v1.1.1 from Docker HubCVE-2026-0768/README.md:73
  • Host port 7860 available (mapped as 17860:7860)CVE-2026-0768/README.md:74CVE-2026-0768/docker-compose.yml:22-23
  • Python 3 standard library (no external dependencies) to run PoC scriptsCVE-2026-0768/README.md:100

Evidence-described exercise path

  1. Start the lab with 'docker compose up -d'CVE-2026-0768/README.md:78
  2. Wait for the container to become healthy (healthcheck polls /health)CVE-2026-0768/README.md:81-86
  3. Run the primary PoC: 'python3 poc/poc.py localhost 17860 "id"'CVE-2026-0768/README.md:104
  4. Optionally run alternative vectors: poc_vector2.py or poc_vector3.pyCVE-2026-0768/README.md:130-131CVE-2026-0768/README.md:142-143
  5. Stop the lab with 'docker compose down'CVE-2026-0768/README.md:95
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is directed at the lab's own vulnerable target container. The PoC scripts send HTTP requests to the local Langflow instance to demonstrate RCE, which is the documented exercise. There is no evidence of host compromise, external communication, persistence, credential theft, or any action outside the intended lab scope. The compose file uses a standard bridge network and port mapping without privileged mode, host namespaces, or Docker socket access.

CVE-2026-0768/poc/poc.py:1-287CVE-2026-0768/poc/poc_vector2.py:1-155CVE-2026-0768/poc/poc_vector3.py:1-198CVE-2026-0768/docker-compose.yml:1-38
Review boundaries

What the analysis did not establish

  • The packet does not include the actual execution output of the PoC scripts; the verification report contains example output but is not a live execution log.
  • The Dockerfile uses a remote base image (langflowai/langflow:v1.1.1) whose contents are not inspected.
  • The compose file uses a local build context ('.') and Dockerfile, but the full build context contents beyond the Dockerfile are not provided.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

6