CVE-2024-37014: Langflow RCE Vulnerability

CVE-2024-37014 Overview

CVE-2024-37014 is a remote code execution vulnerability affecting Langflow through version 0.6.19. The flaw resides in the POST /api/v1/custom_component endpoint, which accepts Python scripts from callers and executes them on the server. Any untrusted user able to reach this endpoint can run arbitrary Python code in the context of the Langflow process.

Langflow is a widely deployed visual builder for LangChain workflows used to prototype large language model (LLM) applications. The vulnerability is tracked under CWE-94: Improper Control of Generation of Code. The EPSS score is 5.96% at the 90.7th percentile, indicating elevated exploitation likelihood.

Critical Impact
Unauthenticated attackers with network access to a Langflow instance can execute arbitrary Python code on the host, leading to full system compromise.

Affected Products

Langflow versions up to and including 0.6.19
Self-hosted Langflow deployments exposing the REST API
Containerized Langflow instances reachable over the network

Discovery Timeline

2024-06-10 - CVE-2024-37014 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-37014

Vulnerability Analysis

Langflow exposes a custom component feature that allows users to define reusable Python building blocks for LLM pipelines. The POST /api/v1/custom_component endpoint accepts a Python script in the request body and evaluates it server-side to extract component metadata such as inputs, outputs, and field definitions.

The endpoint performs no authentication enforcement in default deployments and no sandboxing of the submitted Python code. As a result, anyone who can reach the API can submit arbitrary Python and have it executed by the Langflow process. The classification as [CWE-94] reflects the direct execution of attacker-controlled code.

Successful exploitation yields code execution under the operating system account running Langflow. Attackers can read environment variables containing API keys for OpenAI, Anthropic, vector databases, and cloud services, pivot into adjacent systems, or stage further payloads. See the GitHub Issue Discussion for upstream details.

Root Cause

The root cause is unsafe dynamic evaluation of user-supplied source code. The custom component loader compiles and executes the submitted script to introspect its class definition, instead of parsing it statically or executing it inside an isolated interpreter. Missing authentication on the endpoint compounds the design flaw.

Attack Vector

Exploitation is performed over the network with a single HTTP POST request. The attacker sends a JSON body containing a Python payload to /api/v1/custom_component. The payload can be a minimal class definition whose module-level statements perform actions such as spawning a reverse shell, writing files, or exfiltrating secrets through outbound HTTP requests. No user interaction or prior authentication is required when the instance is deployed with default settings.

No verified public proof-of-concept code is referenced in the NVD entry. Technical context is available in the upstream GitHub Issue Discussion.

Detection Methods for CVE-2024-37014

Indicators of Compromise

HTTP POST requests to /api/v1/custom_component from unexpected source IP addresses or external networks
Langflow process spawning child processes such as sh, bash, python, curl, or wget
Outbound network connections initiated by the Langflow container or service to unknown hosts
New or modified files in the Langflow working directory or user home directory that were not introduced by deployment automation

Detection Strategies

Inspect web server and reverse proxy logs for POST requests to /api/v1/custom_component, correlating source IP, request size, and authentication state
Alert on process lineage where the Langflow Python interpreter spawns shell utilities or network clients
Monitor for unexpected outbound connections from hosts running Langflow, particularly to non-LLM-provider destinations

Monitoring Recommendations

Enable verbose API access logging on Langflow and any fronting proxy, retaining request paths and source addresses
Forward Langflow application and host telemetry to a centralized analytics platform for behavioral correlation
Baseline normal Langflow child-process and network behavior, then alert on deviations such as new outbound destinations or interactive shells

How to Mitigate CVE-2024-37014

Immediate Actions Required

Upgrade Langflow to a fixed release beyond 0.6.19 as published by the maintainers
Remove direct exposure of the Langflow API from the public internet and place it behind an authenticating reverse proxy
Rotate any API keys, tokens, and credentials accessible from the Langflow host, since these may have been exposed
Audit historical access logs for prior POST requests to /api/v1/custom_component

Patch Information

The NVD record identifies Langflow versions up to 0.6.19 as vulnerable. Refer to the Langflow GitHub repository and the linked GitHub Issue Discussion for the fixed version and release notes. Apply the upgrade across all self-hosted and containerized deployments.

Workarounds

Restrict network access to the Langflow API using firewall rules, security groups, or service mesh policies so that only trusted internal clients can reach it
Place Langflow behind an authenticating gateway that enforces strong identity controls on every request
Run Langflow as a non-privileged user inside an isolated container with read-only file systems and egress filtering to limit blast radius if exploited

bash

# Example: restrict Langflow API access to an internal CIDR with iptables
iptables -A INPUT -p tcp --dport 7860 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 7860 -j DROP

# Example: block the vulnerable endpoint at an nginx reverse proxy
# location = /api/v1/custom_component {
#     deny all;
#     return 403;
# }