CVE-2024-37014: Langflow RCE Vulnerability

CVE-2024-37014 Overview

CVE-2024-37014 is a remote code execution vulnerability affecting Langflow through version 0.6.19. The flaw resides in the POST /api/v1/custom_component endpoint, which accepts Python scripts from callers and executes them on the server. Any untrusted user able to reach this endpoint can run arbitrary Python code in the context of the Langflow process.

Langflow is a widely deployed visual builder for LangChain workflows used to prototype large language model (LLM) applications. The vulnerability is tracked under CWE-94: Improper Control of Generation of Code. The EPSS score is 5.96% at the 90.7th percentile, indicating elevated exploitation likelihood.

Critical Impact

Unauthenticated attackers with network access to a Langflow instance can execute arbitrary Python code on the host, leading to full system compromise.

Affected Products

• Langflow versions up to and including 0.6.19
• Self-hosted Langflow deployments exposing the REST API
• Containerized Langflow instances reachable over the network

Discovery Timeline

• 2024-06-10 - CVE-2024-37014 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-37014

Vulnerability Analysis

Langflow exposes a custom component feature that allows users to define reusable Python building blocks for LLM pipelines. The POST /api/v1/custom_component endpoint accepts a Python script in the request body and evaluates it server-side to extract component metadata such as inputs, outputs, and field definitions.

The endpoint performs no authentication enforcement in default deployments and no sandboxing of the submitted Python code. As a result, anyone who can reach the API can submit arbitrary Python and have it executed by the Langflow process. The classification as [CWE-94] reflects the direct execution of attacker-controlled code.

Successful exploitation yields code execution under the operating system account running Langflow. Attackers can read environment variables containing API keys for OpenAI, Anthropic, vector databases, and cloud services, pivot into adjacent systems, or stage further payloads. See the GitHub Issue Discussion for upstream details.

Root Cause

The root cause is unsafe dynamic evaluation of user-supplied source code. The custom component loader compiles and executes the submitted script to introspect its class definition, instead of parsing it statically or executing it inside an isolated interpreter. Missing authentication on the endpoint compounds the design flaw.

Attack Vector

Exploitation is performed over the network with a single HTTP POST request. The attacker sends a JSON body containing a Python payload to /api/v1/custom_component. The payload can be a minimal class definition whose module-level statements perform actions such as spawning a reverse shell, writing files, or exfiltrating secrets through outbound HTTP requests. No user interaction or prior authentication is required when the instance is deployed with default settings.

No verified public proof-of-concept code is referenced in the NVD entry. Technical context is available in the upstream GitHub Issue Discussion.

Detection Methods for CVE-2024-37014

Indicators of Compromise

• HTTP POST requests to /api/v1/custom_component from unexpected source IP addresses or external networks
• Langflow process spawning child processes such as sh, bash, python, curl, or wget
• Outbound network connections initiated by the Langflow container or service to unknown hosts
• New or modified files in the Langflow working directory or user home directory that were not introduced by deployment automation

Detection Strategies

• Inspect web server and reverse proxy logs for POST requests to /api/v1/custom_component, correlating source IP, request size, and authentication state
• Alert on process lineage where the Langflow Python interpreter spawns shell utilities or network clients
• Monitor for unexpected outbound connections from hosts running Langflow, particularly to non-LLM-provider destinations

Monitoring Recommendations

• Enable verbose API access logging on Langflow and any fronting proxy, retaining request paths and source addresses
• Forward Langflow application and host telemetry to a centralized analytics platform for behavioral correlation
• Baseline normal Langflow child-process and network behavior, then alert on deviations such as new outbound destinations or interactive shells

How to Mitigate CVE-2024-37014

Immediate Actions Required

• Upgrade Langflow to a fixed release beyond 0.6.19 as published by the maintainers
• Remove direct exposure of the Langflow API from the public internet and place it behind an authenticating reverse proxy
• Rotate any API keys, tokens, and credentials accessible from the Langflow host, since these may have been exposed
• Audit historical access logs for prior POST requests to /api/v1/custom_component

Patch Information

The NVD record identifies Langflow versions up to 0.6.19 as vulnerable. Refer to the Langflow GitHub repository and the linked GitHub Issue Discussion for the fixed version and release notes. Apply the upgrade across all self-hosted and containerized deployments.

Workarounds

• Restrict network access to the Langflow API using firewall rules, security groups, or service mesh policies so that only trusted internal clients can reach it
• Place Langflow behind an authenticating gateway that enforces strong identity controls on every request
• Run Langflow as a non-privileged user inside an isolated container with read-only file systems and egress filtering to limit blast radius if exploited

# Example: restrict Langflow API access to an internal CIDR with iptables
iptables -A INPUT -p tcp --dport 7860 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 7860 -j DROP

# Example: block the vulnerable endpoint at an nginx reverse proxy
# location = /api/v1/custom_component {
#     deny all;
#     return 403;
# }