CVE-2024-42835: Langflow: Unauthenticated RCE via PythonCodeTool

Q: Is CVE-2024-42835 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2024-42835, increasing the risk of exploitation.

Q: How to fix CVE-2024-42835?

1. IMMEDIATE: Isolate all Langflow instances ≤1.0.12 behind VPN or firewall rules; remove any public internet exposure. 2. AUDIT: Review Langflow deployment configs for hardcoded API keys, credentials, or service account tokens — rotate all of them. 3. PATCH: Monitor the Langflow GitHub repo and pip releases for a patched version; no official fix was available at CVE publication. 4. DETECT: Review logs for unusual Python process spawning, outbound connections from the Langflow process, and unexpected file writes. 5. CONTAIN: If compromise is suspected, treat the host as compromised — rotate all credentials accessible from that environment and review downstream connected services.

Q: What systems are affected by CVE-2024-42835?

This vulnerability affects the following AI/ML architecture patterns: LLM workflow builders, Visual AI pipeline editors, AI agent frameworks, RAG pipeline development environments, LLM application prototyping platforms.

Q: What is the CVSS score for CVE-2024-42835?

CVE-2024-42835 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 1.16%.

GHSA-56m6-4mhw-h3g5CRITICALPoC AVAILABLECISA: ATTEND

Published October 31, 2024

CISO Take

Any Langflow instance ≤1.0.12 exposed to the network is a critical liability — unauthenticated attackers can execute arbitrary code with the privileges of the Langflow process. Take all public-facing Langflow deployments offline immediately or restrict access to VPN/allowlisted IPs. Given no official patch is listed, assume compromise on any externally-facing instance and investigate for lateral movement to cloud credentials and LLM API keys.

What is the risk?

Severity is as high as it gets: CVSS 9.8 with network-accessible, zero-authentication, zero-interaction exploitation. EPSS of ~16% indicates active exploitation interest from the security community. Langflow is commonly deployed in cloud environments (often with public-facing dashboards for team collaboration), dramatically widening the attack surface. The combination of no auth + code execution in an AI framework creates a direct path to cloud credentials, LLM API keys, and connected data stores.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
156.2KPushed 5d ago18% patched~75d to patchFull package profile →
Langflow	pip	<= 1.0.12	No patch
156.2KPushed 5d ago18% patched~75d to patchFull package profile →

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

1.2%

chance of exploitation in 30 days

Higher than 67% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CHigh

IHigh

AHigh

What should I do?

5 steps

IMMEDIATE
Isolate all Langflow instances ≤1.0.12 behind VPN or firewall rules; remove any public internet exposure.
AUDIT
Review Langflow deployment configs for hardcoded API keys, credentials, or service account tokens — rotate all of them.
PATCH
Monitor the Langflow GitHub repo and pip releases for a patched version; no official fix was available at CVE publication.
DETECT
Review logs for unusual Python process spawning, outbound connections from the Langflow process, and unexpected file writes.
CONTAIN
If compromise is suspected, treat the host as compromised — rotate all credentials accessible from that environment and review downstream connected services.

What does CISA's SSVC say?

DecisionAttend

Exploitationpoc

AutomatableYes

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code ExecutionSupply ChainData ExtractionFrameworkAgentPluginAML.T0049- Exploit Public-Facing Application AML.T0050- Command and Scripting Interpreter AML.T0053- AI Agent Tool Invocation AML.T0072- Reverse Shell AML.T0083- Credentials from AI Agent Configuration AML.T0105- Escape to Host

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, Robustness and Cybersecurity

ISO 42001

A.6.2-AI Risk ManagementA.9.3-Information Security for AI Systems

NIST AI RMF

MANAGE 2.4-Response to identified AI risks

OWASP LLM Top 10

LLM07-Insecure Plugin DesignLLM08-Excessive Agency

Frequently Asked Questions

What is CVE-2024-42835?

Is CVE-2024-42835 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2024-42835, increasing the risk of exploitation.

How to fix CVE-2024-42835?

1. IMMEDIATE: Isolate all Langflow instances ≤1.0.12 behind VPN or firewall rules; remove any public internet exposure. 2. AUDIT: Review Langflow deployment configs for hardcoded API keys, credentials, or service account tokens — rotate all of them. 3. PATCH: Monitor the Langflow GitHub repo and pip releases for a patched version; no official fix was available at CVE publication. 4. DETECT: Review logs for unusual Python process spawning, outbound connections from the Langflow process, and unexpected file writes. 5. CONTAIN: If compromise is suspected, treat the host as compromised — rotate all credentials accessible from that environment and review downstream connected services.

What systems are affected by CVE-2024-42835?

This vulnerability affects the following AI/ML architecture patterns: LLM workflow builders, Visual AI pipeline editors, AI agent frameworks, RAG pipeline development environments, LLM application prototyping platforms.

What is the CVSS score for CVE-2024-42835?

CVE-2024-42835 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 1.16%.

What is the AI security impact?

Affected AI Architectures

LLM workflow buildersVisual AI pipeline editorsAI agent frameworksRAG pipeline development environmentsLLM application prototyping platforms

MITRE ATLAS Techniques

AML.T0049Exploit Public-Facing Application

AML.T0050Command and Scripting Interpreter

AML.T0053AI Agent Tool Invocation

AML.T0072Reverse Shell

AML.T0083Credentials from AI Agent Configuration

AML.T0105Escape to Host

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2, A.9.3

NIST AI RMF: MANAGE 2.4

OWASP LLM Top 10: LLM07, LLM08

What are the technical details?

Original Advisory

langflow v1.0.12 was discovered to contain a remote code execution (RCE) vulnerability via the PythonCodeTool component.

Exploitation Scenario

An attacker scans for exposed Langflow instances (Shodan/Censys queries for Langflow UI signatures are trivial). They access the unauthenticated web UI or API endpoint, create a flow using the PythonCodeTool component, and inject a Python reverse shell payload. Upon execution, they gain shell access as the Langflow process user. From there, they extract environment variables and config files to harvest LLM API keys, database credentials, and cloud provider tokens. With API key access, they can exfiltrate proprietary prompts, fine-tuning data, or conduct cost-harvesting attacks at the victim's expense.