CVE-2024-37014: Langflow unauthenticated RCE

Q: Is CVE-2024-37014 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2024-37014, increasing the risk of exploitation.

Q: How to fix CVE-2024-37014?

1) Patch: Upgrade to Langflow 1.0.15 or later immediately—this is the only complete fix. 2) Emergency workaround (if patching is blocked): Restrict network access to /api/v1/custom_component via WAF rule or reverse proxy ACL; allow only authenticated admin IPs. 3) Network segmentation: Langflow should never be directly internet-facing; place behind VPN or internal network boundary. 4) Audit credentials: Rotate all LLM API keys, DB credentials, and service tokens stored in or accessible from the Langflow instance—assume compromise if exposed. 5) Detection: Search logs for POST requests to /api/v1/custom_component from unexpected source IPs. Monitor for anomalous process spawning from the Langflow process. 6) Verify: Confirm your deployed version with 'pip show langflow'.

Q: What systems are affected by CVE-2024-37014?

This vulnerability affects the following AI/ML architecture patterns: LLM workflow orchestration platforms, Agent frameworks, AI development environments, Model serving pipelines, RAG pipelines.

Q: What is the CVSS score for CVE-2024-37014?

CVE-2024-37014 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 0.92%.

CISO Take

Any Langflow instance below 1.0.15 with the API exposed to untrusted networks is fully compromised on a single unauthenticated POST request—no credentials, no interaction required. Patch immediately to 1.0.15+ or firewall the /api/v1/custom_component endpoint as an emergency workaround. Audit whether Langflow is internet-facing in your AI development or production environments; this is not a theoretical risk.

What is the risk?

Extremely high. CVSS 9.8 with AV:N/AC:L/PR:N/UI:N means any attacker with network reach can execute arbitrary Python on the host—no authentication, no complexity, no user involvement. Langflow is widely deployed as an LLM workflow builder in both dev and prod AI environments, often with privileged access to LLM APIs, vector stores, and internal data. EPSS of 6.5% indicates measurable real-world exploitation interest. The absence from CISA KEV does not mean safe—this class of unauthenticated RCE is trivially weaponized.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
149.9K Pushed 3d ago 40% patched ~67d to patch Full package profile →
Langflow	pip	< 1.0.15	`1.0.15`
149.9K Pushed 3d ago 40% patched ~67d to patch Full package profile →

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

0.9%

chance of exploitation in 30 days

Higher than 56% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I High

A High

What should I do?

1 step

1) Patch: Upgrade to Langflow 1.0.15 or later immediately—this is the only complete fix. 2) Emergency workaround (if patching is blocked): Restrict network access to /api/v1/custom_component via WAF rule or reverse proxy ACL; allow only authenticated admin IPs. 3) Network segmentation: Langflow should never be directly internet-facing; place behind VPN or internal network boundary. 4) Audit credentials: Rotate all LLM API keys, DB credentials, and service tokens stored in or accessible from the Langflow instance—assume compromise if exposed. 5) Detection: Search logs for POST requests to /api/v1/custom_component from unexpected source IPs. Monitor for anomalous process spawning from the Langflow process. 6) Verify: Confirm your deployed version with 'pip show langflow'.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Auth Bypass Supply Chain Framework Agent API AML.T0010.001 - AI Software AML.T0049 - Exploit Public-Facing Application AML.T0050 - Command and Scripting Interpreter AML.T0072 - Reverse Shell AML.T0083 - Credentials from AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15(1) - Accuracy, robustness and cybersecurity for high-risk AI systems

ISO 42001

A.6.2.5 - AI System Security A.8.4 - AI Incident Management

NIST AI RMF

GOVERN-1.7 - Organizational risk tolerance processes for AI MANAGE-2.2 - Mechanisms to respond to and recover from AI risks

OWASP LLM Top 10

LLM07 - Insecure Plugin Design

Frequently Asked Questions

What is CVE-2024-37014?

Any Langflow instance below 1.0.15 with the API exposed to untrusted networks is fully compromised on a single unauthenticated POST request—no credentials, no interaction required. Patch immediately to 1.0.15+ or firewall the /api/v1/custom_component endpoint as an emergency workaround. Audit whether Langflow is internet-facing in your AI development or production environments; this is not a theoretical risk.

Is CVE-2024-37014 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2024-37014, increasing the risk of exploitation.

How to fix CVE-2024-37014?

1) Patch: Upgrade to Langflow 1.0.15 or later immediately—this is the only complete fix. 2) Emergency workaround (if patching is blocked): Restrict network access to /api/v1/custom_component via WAF rule or reverse proxy ACL; allow only authenticated admin IPs. 3) Network segmentation: Langflow should never be directly internet-facing; place behind VPN or internal network boundary. 4) Audit credentials: Rotate all LLM API keys, DB credentials, and service tokens stored in or accessible from the Langflow instance—assume compromise if exposed. 5) Detection: Search logs for POST requests to /api/v1/custom_component from unexpected source IPs. Monitor for anomalous process spawning from the Langflow process. 6) Verify: Confirm your deployed version with 'pip show langflow'.

What systems are affected by CVE-2024-37014?

This vulnerability affects the following AI/ML architecture patterns: LLM workflow orchestration platforms, Agent frameworks, AI development environments, Model serving pipelines, RAG pipelines.

What is the CVSS score for CVE-2024-37014?

CVE-2024-37014 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 0.92%.

What is the AI security impact?

Affected AI Architectures

LLM workflow orchestration platformsAgent frameworksAI development environmentsModel serving pipelinesRAG pipelines

MITRE ATLAS Techniques

AML.T0010.001 AI Software

AML.T0049 Exploit Public-Facing Application

AML.T0050 Command and Scripting Interpreter

AML.T0072 Reverse Shell

AML.T0083 Credentials from AI Agent Configuration

Compliance Controls Affected

EU AI Act: Article 15(1)

ISO 42001: A.6.2.5, A.8.4

NIST AI RMF: GOVERN-1.7, MANAGE-2.2

OWASP LLM Top 10: LLM07

What are the technical details?

Original Advisory

Langflow through 0.6.19 allows remote code execution if untrusted users are able to reach the "POST /api/v1/custom_component" endpoint and provide a Python script.

Exploitation Scenario

Attacker discovers a Langflow instance via Shodan or known internal inventory. They send a single unauthenticated HTTP POST to /api/v1/custom_component with a JSON body containing a malicious Python script—e.g., a reverse shell payload or credential harvester. Langflow evaluates the script server-side with no sandboxing. The attacker immediately gains shell access, enumerates environment variables to extract LLM API keys and DB credentials, and pivots to connected AI infrastructure. In an agentic deployment, the attacker can inject malicious component logic that persists across legitimate workflow runs, silently exfiltrating data or manipulating AI outputs without raising alerts.

Weaknesses (CWE)

CWE-913 Improper Control of Dynamically-Managed Code Resources Primary CWE-94 Improper Control of Generation of Code ('Code Injection') Primary CWE-94 Improper Control of Generation of Code ('Code Injection')

CWE-913 — Improper Control of Dynamically-Managed Code Resources: The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.

[Implementation] For any externally-influenced input, check the input against an allowlist of acceptable values.
[Implementation, Architecture and Design] Refactor the code so that it does not need to be dynamically managed.

Source: MITRE CWE corpus.