Langflow's Unauthenticated RCE Became a Botnet
An endpoint built to 'validate' user code actually ran it — with no login required, on any exposed server.
| When | April 2025 (CISA KEV 5 May) |
|---|---|
| Target | Langflow (LLM app builder) |
| Researcher | Horizon3.ai |
| Technique | Unauthenticated code execution via exec() endpoint |
| CVE | CVE-2025-3248 — CVSS 9.8; CISA KEV |
- 1An attacker finds an internet-exposed Langflow instance
- 2They POST to /api/v1/validate/code, which runs the payload via exec() unauthenticated
- 3Arbitrary code executes; attackers used it in the wild to install a botnet
What happened
In 2025, Horizon3.ai detailed CVE-2025-3248 (CVSS 9.8): an unauthenticated remote-code-execution flaw in Langflow, a popular low-code builder for LLM apps and agents. CISA added it to the Known Exploited Vulnerabilities catalog on 5 May 2025, and in June Trend Micro reported an active campaign using it to install the Flodrix botnet on exposed instances. It was fixed in Langflow 1.3.0.
How the attack worked
The /api/v1/validate/code endpoint — meant to check user-supplied code — actually executed it with Python's exec(), and required no authentication. Any attacker who could reach the server could run arbitrary code on it and take it over.
Root cause
User-supplied code was executed rather than sandboxed, behind an endpoint with no authentication — a fatal combination in a widely self-hosted AI tool.
Why it matters
Low-code AI builders are deployed casually and often exposed. This one became a real, in-the-wild botnet campaign — not a lab PoC — soon after the flaw went public.
How to prevent it
- Patch to 1.3.0+ and don't expose AI builders to the internet without auth.
- Never run user-provided code outside a sandbox.
- Watch CISA KEV for the AI tools you deploy and act fast.
FAQ
What was the flaw?
An endpoint meant to validate user code actually executed it with exec(), and it required no authentication. So anyone who could reach the server could run arbitrary Python on it — a classic unauth-RCE in a widely-deployed LLM app-builder.
How serious was exploitation?
Serious enough that CISA added it to the Known Exploited Vulnerabilities catalog and Trend Micro tracked an active campaign using it to install the Flodrix DDoS botnet on exposed instances — this was real in-the-wild compromise, not a lab PoC.
How do you defend?
Patch to 1.3.0+, never expose low-code AI builders to the internet without authentication, and don't run user-provided code outside a sandbox.