CVE-2024-37014

What it actually does

Langflow versions through 0.6.19 expose a custom component API that can execute attacker-supplied Python when the endpoint is reachable by untrusted users. Because exploitation is network-accessible, low-complexity, unauthenticated, and requires no user interaction, an attacker can run arbitrary code in the security context of the Langflow service. Successful exploitation can lead to full compromise of the application process, access to environment variables and secrets, modification of flows or application data, lateral movement using any credentials available to the service, and service disruption.

Why it matters to the business

A publicly reachable vulnerable Langflow instance can be taken over remotely, potentially exposing API keys, model credentials, workflow data, and connected service tokens. The issue has a critical CVSS score of 9.8, high EPSS likelihood, and weaponized exploit maturity, so organizations should treat internet-exposed deployments as high-priority even though the vulnerability is not currently listed in CISA KEV. Because Langflow is commonly used to orchestrate AI workflows and integrations, compromise may affect downstream systems that trust Langflow outputs or credentials.

How an attack unfolds

An attacker first identifies a Langflow deployment and checks whether the custom component endpoint is reachable. They then send a crafted POST request to /api/v1/custom_component containing Python code embedded as a custom component. Vulnerable Langflow versions process the supplied component and execute the Python code server-side. The attacker can use this execution to run commands, read local files, enumerate environment variables, steal API keys or cloud credentials, install persistence, or pivot to systems reachable from the Langflow host. In more advanced attacks, the initial payload may download a second-stage script, open a reverse shell, create a new backdoor component, or abuse Langflow’s integrations to access external services.

How to fix it

Upgrade Langflow to a version newer than 0.6.19 that contains the vendor fix. If an exact fixed version is not available from package metadata, consult the Langflow release notes and install the latest stable release. Restrict access to /api/v1/custom_component to trusted administrators only, and do not expose Langflow management APIs directly to the internet. Place Langflow behind authentication, authorization, and network controls such as VPN, private ingress, allowlists, or reverse-proxy access rules. If immediate upgrade is not possible, disable or block the custom component endpoint at the proxy/WAF layer, remove public exposure, and run Langflow with a least-privileged service account. Rotate any credentials, API keys, model provider tokens, cloud keys, and integration secrets that may have been accessible to the Langflow process.

How to confirm the fix worked

Confirm that all Langflow instances report a version later than 0.6.19 or are running the latest stable release. From an untrusted network location, verify that POST requests to /api/v1/custom_component are blocked, require strong authentication, or return an authorization failure. Review reverse proxy, ingress, WAF, and application routing rules to ensure the endpoint is not publicly reachable. In package inventories, container images, and virtual environments, search for installed Langflow versions through 0.6.19. After remediation, test that custom component functionality cannot execute arbitrary Python from unauthenticated or untrusted users. Validate that secrets used by Langflow have been rotated where exposure is possible.

Typical attack path

1. Scan for exposed Langflow services on the internet or internal network.
2. Confirm that the target is running a vulnerable version through 0.6.19 or that /api/v1/custom_component is accessible.
3. Send a POST request to /api/v1/custom_component containing attacker-controlled Python code.
4. Execute commands or Python functions in the context of the Langflow server process.
5. Collect environment variables, local configuration files, API keys, model provider tokens, and credentials available to the service.
6. Optionally download additional tooling, establish reverse shell access, or create persistence.
7. Use stolen credentials or network access from the Langflow host to pivot to connected services or disrupt application workflows.

How to detect it

Investigate application, reverse proxy, ingress controller, API gateway, WAF, and web server access logs for POST requests to /api/v1/custom_component, especially from unknown IP addresses, internet scanners, or unauthenticated sessions. Review request bodies, if retained, for Python code execution patterns such as imports of os, subprocess, socket, pty, base64 decoding, curl, wget, bash, or reverse shell syntax. On hosts or containers running Langflow, examine process telemetry for unexpected child processes spawned by the Langflow or Python service, including shells, download utilities, interpreters, crypto miners, or network tools. Review outbound network logs for new connections shortly after custom component requests, especially to uncommon ports, paste sites, file hosting services, VPS providers, or command-and-control infrastructure. Inspect filesystem artifacts for newly created scripts, modified Langflow component files, unauthorized flow changes, cron entries, systemd services, SSH authorized_keys additions, or temporary payloads in /tmp and application working directories. Because exploitation executes within the application context, absence of a distinct malware artifact does not prove safety; correlate endpoint access, process behavior, secret access, and outbound connections over the same time window.

• POST /api/v1/custom_component
• /api/v1/custom_component
• custom_component
• import os
• import subprocess
• subprocess.Popen
• os.system
• os.popen
• import socket
• socket.socket
• /bin/sh
• /bin/bash
• bash -c
• sh -c
• python -c
• python3 -c
• curl http
• curl -O
• curl -fsSL
• wget http
• wget -O
• nc -e
• ncat -e
• mkfifo /tmp
• pty.spawn
• base64.b64decode
• chmod +x /tmp
• /tmp/
• authorized_keys
• crontab -e

What your security team should do

• Immediately inventory all Langflow deployments, including containers, development servers, notebooks, AI labs, and internal proof-of-concept systems.
• Prioritize internet-facing or unauthenticated Langflow instances for emergency containment because exploitation is weaponized and the EPSS probability is high.
• Upgrade vulnerable installations through 0.6.19 to a patched current release, or remove external access until upgraded.
• Block or tightly restrict POST access to /api/v1/custom_component at reverse proxies, API gateways, ingress controllers, and WAFs.
• Review logs for historical access to the custom component endpoint, especially requests containing Python execution primitives or followed by outbound network connections.
• Rotate credentials and tokens accessible to the Langflow service, including LLM provider keys, cloud credentials, database credentials, and workflow integration secrets.
• Hunt for suspicious child processes, outbound connections, downloaded scripts, reverse shells, and unauthorized changes to Langflow flows or components.
• Run Langflow with least privilege, isolated containers, read-only filesystems where practical, and restricted egress to reduce post-exploitation impact.