Listen to this article
In this issue - 4 parts
Part 1 of 4
A Code Runner Without a Lock
The Problem: Remote Python Execution With No Authentication Check
Langflow is a popular open-source visual builder for AI agents and large language model workflows. It gives teams a graphical way to connect models, prompts, data sources, and tools into working flows. That convenience makes complex AI systems easier to assemble, but it also means a Langflow server can sit close to valuable models, data, credentials, and business processes.
Trend Micro described Langflow as a Python-powered framework with more than 70,000 GitHub stars when it published its June 2025 investigation. Popularity is not evidence that every deployment was exposed or vulnerable, but it explains why this was not an obscure lab component. Teams use Langflow to prototype and deploy intelligent automation. The server often becomes the point where experimental prompts meet production-capable code, network access, and secrets.
CVE-2025-3248 exposed a direct path into that server. Langflow shipped an endpoint at /api/v1/validate/code without an authentication check. A remote attacker who could reach the endpoint did not need a username, password, session, or token. The endpoint could be abused to execute arbitrary Python code.
The sequence contains almost no defensive friction. The attacker only needs network reachability and a crafted HTTP request. There is no account to compromise, no user to persuade, and no local access to establish first. The request arrives at a function intended to validate Python, and the service itself performs the steps that turn attacker-controlled syntax into code running in the server context.
That is a missing-authentication remote code execution flaw, not a prompt-injection thought experiment and not a limited information leak. The vulnerable service accepted a request from an untrusted remote caller and allowed that request to become Python running on the host. The vulnerability received a CVSS score of 9.8, placing it in the Critical range.
What Langflow Does, and Why Its Server Matters
A visual AI workflow builder is more than a diagramming tool. The boxes on its canvas represent components that can call models, move data, and coordinate agent behavior. When a team runs a flow, the server turns the visual design into real computation. That makes the server useful, and it makes code execution on that server consequential.
The practical blast radius is therefore deployment-specific. A minimally connected test instance and a production-connected instance do not create the same consequence, even when the vulnerability is identical. A host may be able to read environment variables, reach an internal model endpoint, query a database, call an external API, or assume a cloud role. Arbitrary Python inherits whatever the process and network are allowed to do. The CVE tells you the door is open; your identity, secret, dependency, and network maps tell you which rooms sit behind it.
The vulnerability was located in a code-validation endpoint. Validation should be a safety function: inspect submitted code and decide whether it is acceptable. Here, the endpoint itself lacked the most basic boundary at its front door. Before considering what code was being validated, the service should have established whether the caller was authorized to submit anything at all.
That inversion is the central governance lesson. Teams often concentrate on whether submitted code is safe while treating access to the checker as plumbing. But a checker that compiles and executes part of its input is already a high-authority component. Its own identity boundary, runtime isolation, telemetry, and outbound policy deserve at least as much scrutiny as the code it is supposed to inspect.
How Missing Authentication Became RCE
1. Reach the endpoint
A remote caller sends a request to the exposed code-validation route.
2. Skip identity
The endpoint performs no authentication check before accepting the request.
3. Run Python
The attacker turns the validation function into arbitrary Python execution.
Recorded Future and Trend Micro describe the same mechanism in more detail. The endpoint parsed submitted Python into an Abstract Syntax Tree with ast.parse(), compiled selected syntax, and used exec(). Function decorators and default argument expressions can be evaluated as part of creating a function definition. An attacker could hide a payload in those locations so the act of "validating" the function executed it.
The issue was not simply that Python is expressive. It was the unsafe combination of attacker-controlled syntax, compilation and execution inside the server context, inadequate input controls, no sandbox boundary, and no authentication requirement at the route. Removing any one of those paths would have added friction. Leaving them aligned created remote code execution.
Why CVSS 9.8 Fits the Failure
The attack was remote, required no authentication, and ended in arbitrary code execution. Each of those facts removes a layer a defender might otherwise rely on. There was no stolen account to detect, no legitimate user session to revoke, and no local foothold required before reaching the vulnerable function.
The CVSS vector makes that compactly visible: network reachable, low attack complexity, no privileges required, no user interaction, and high potential impact to confidentiality, integrity, and availability. A 9.8 score does not predict what happened on every server. It does tell a responder that the preconditions are minimal and the possible consequence is broad, which is exactly the combination that should bypass a routine monthly patch queue.
The control failure is easy to state: an endpoint capable of turning submitted content into executable code was available without first establishing who was calling. For any AI platform that can reach models, data, or other systems, authentication cannot be an optional wrapper around powerful functions. It must be a fail-closed prerequisite.
Authentication is also only the first gate. An authenticated but over-privileged user, a stolen session, or another parser flaw can still create dangerous execution. The durable design combines identity with authorization, safe parsing, isolation, least privilege, egress control, and evidence. CVE-2025-3248 became critical because several of those layers were absent at the same point.
Why this matters beyond Langflow
AI infrastructure is frequently introduced under the label "developer tool," which can exempt it in practice from the controls applied to a customer-facing application. But a tool that can run code, call models, hold API keys, and connect to data is already production-capable infrastructure. Its business label does not reduce its technical authority.
Inventory the authority of the deployed system, not the intent of the team that installed it. If an experimental service can execute code against production-connected credentials, the risk decision is already a production decision.
The endpoint did not fail at deciding whether an action was safe. It failed before that: it never asked whether the caller was allowed to act.
Coming up in Part 2 - the disclosure timeline, the first observed exploitation, and the later Flodrix botnet campaign.
Part 2 of 4
Disclosure Became Exploitation Within Days
What you missed: Langflow exposed a Python code-execution endpoint without authentication, producing a Critical CVSS 9.8 RCE.
The Incident Timeline
CVE-2025-3248 was assigned on April 3, 2025, and published on April 7. SANS Internet Storm Center observed real-world scanning and exploitation attempts against the vulnerable endpoint from April 10 through April 12. The distance between public disclosure and hostile activity was measured in days.
This is the clock that matters. A disclosure date is often treated as the start of an internal prioritization process: identify an owner, test a patch, negotiate a window, and schedule deployment. For a remotely reachable, unauthenticated RCE, hostile infrastructure is running its own process in parallel. By April 10, only three days after publication, the question had already changed from "could someone exploit this?" to "which of our systems have already received the request?"
CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on May 5, requiring federal agencies to remediate it. That catalog entry confirmed that this was no longer a theoretical exposure. Exploitation continued afterward, and Trend Micro later reported compromised Langflow instances being used to deploy the Flodrix DDoS botnet.
The milestones do different jobs. CVE publication distributes technical knowledge. SANS ISC observations establish that hostile traffic was arriving. KEV inclusion raises remediation priority with evidence of exploitation. Trend Micro's later investigation shows post-exploitation purpose. Waiting for the final milestone means waiting until a vulnerability has already acquired an ecosystem: scanners, public proof-of-concept code, target lists, downloaders, and malware.
| Date | Verified Event | Why It Matters |
|---|---|---|
| April 3, 2025 | CVE-2025-3248 was assigned. | The flaw entered the formal vulnerability record. |
| April 7, 2025 | The CVE was published. | Defenders and attackers could act on public details. |
| April 10-12, 2025 | SANS ISC observed scanning and exploitation attempts. | Real-world activity followed only days after publication. |
| May 5, 2025 | CISA added the flaw to the KEV catalog. | Federal remediation became mandatory. |
| Afterward | Trend Micro reported Flodrix deployed through compromised instances. | Exploitation matured from scanning into botnet delivery. |
The Observed Attack Path: From Search Result to Command and Control
Trend Micro reconstructed an operational chain that began with public exposure. Attackers gathered IP addresses and ports for reachable Langflow servers, potentially using internet search services such as Shodan or FOFA. They used public proof-of-concept code to obtain remote shell access, ran reconnaissance commands, and returned results to command-and-control infrastructure. Only then did they download and execute Flodrix.
1. Discover and execute
Find a reachable server, submit a crafted POST request, and turn the validation route into a shell. No credential theft or user interaction has to precede execution.
2. Profile the foothold
Run system reconnaissance and return the results to command and control. The server is evaluated not only as a victim, but as an asset with a particular architecture and set of reachable resources.
3. Fetch the downloader
Use a shell command to retrieve a script named "docker" from attacker infrastructure. The ordinary name is camouflage; it is not evidence that Docker itself caused the compromise.
4. Select and run Flodrix
Attempt binaries for multiple system architectures, establish command-and-control communications, and make the compromised host available for DDoS commands.
This chain explains why patching and incident response cannot be separated after exploitation is observed. An upgrade can close the entry route, but it does not erase commands already run, credentials already read, processes already launched, or persistence already established. A system that was reachable during the exploitation window should be triaged as potentially compromised until evidence supports a narrower conclusion.
It also shows the value of egress controls. The original request was inbound, but the useful campaign depended on outbound stages: returning reconnaissance, fetching a script, downloading a matching binary, and reaching command and control. Preventing the first request is best. Blocking the next unapproved destination can still convert full remote execution into a contained, observable failure.
From Scanning to a DDoS Botnet
The April observations matter because they show how quickly a newly public flaw can attract attention. The later Flodrix reporting matters for a different reason: it shows the operational end state. A compromised Langflow instance was not merely proof that an endpoint could be reached. Attackers used vulnerable systems to deploy malware and add them to a DDoS botnet.
This progression is the practical lifecycle defenders should expect. Public vulnerability information becomes scanning, scanning finds reachable systems, and a reachable system becomes infrastructure for an attacker's campaign. CISA's KEV addition was an urgent remediation signal, but the continued exploitation shows that catalog status does not remove vulnerable deployments from the internet.
Trend Micro found that the downloader attempted to retrieve ELF binaries for multiple architectures. Its analysis characterized Flodrix as an evolving LeetHozer-family variant with self-deletion, artifact removal, string obfuscation, and both TCP and UDP communication paths. Once connected, it could receive DDoS parameters such as attack type, target, port, and duration. The campaign did not need the Langflow application after initial access; it needed the compute and network position underneath it.
There is an important restraint in the evidence. A reachable Langflow instance is not automatically vulnerable, and a vulnerable one is not automatically compromised. Recorded Future reported 1,050 exposed Langflow instances in Shodan at the time of its assessment, while explicitly warning that version visibility was incomplete. It also cited GreyNoise observing 361 malicious IP addresses attempting exploitation. Those numbers describe exposure and hostile attention, not a confirmed victim count.
"Attackers use the vulnerability to execute downloader scripts on compromised Langflow servers, which in turn fetch and install the Flodrix malware."
Trend Micro threat research, June 17, 2025
The incident also shows why an AI development tool belongs in the same asset inventory and exposure-management program as any other internet-facing application. A visual builder may begin as a developer convenience. Once deployed on a reachable server, it is a production attack surface.
The attacker does not care whether the server is listed in the CMDB, classified as a prototype, or owned by a central platform team. Search engines reveal network facts, exploit code tests application facts, and malware monetizes the resulting host. Governance has to be at least as grounded in the deployed reality.
Coming up in Part 3 - the control gaps that converted a missing identity check into a botnet foothold.
Part 3 of 4
The Governance Failure Behind the RCE
What you missed: exploitation followed disclosure within days, entered CISA's KEV catalog, and later delivered the Flodrix DDoS botnet.
By The Numbers
9.8
CVSS Score
3 days
Publication to First Observed Activity
1,050
Exposed Instances Seen by Shodan
361
Malicious IPs Cited by GreyNoise
Exposure and malicious-IP figures were reported by Recorded Future at the time of its May 2025 assessment. Exposed did not necessarily mean vulnerable, and attempts did not necessarily mean successful compromise.
Operational Impact
One unauthenticated request could become server-side Python execution, turning an AI workflow builder into a foothold for reconnaissance, malware delivery, data exposure, and DDoS operations.
Control Gaps and Consequences
The incident can be translated into a small set of control failures. Each one is familiar, but their combination made exploitation immediate and useful.
The useful question is not which single product should have prevented the breach. It is where an independent control could have broken the chain. Identity could have stopped the request. Network policy could have removed reachability. safer code handling could have prevented execution. Runtime controls could have denied the shell. Egress policy could have blocked the downloader or command and control. Rapid response could have shortened exposure. Recovery readiness could have turned uncertain hosts into clean ones.
| Control Gap | Verified Evidence | Governance Implication |
|---|---|---|
| Identity before execution | The code-validation endpoint had no authentication check. | Powerful routes must fail closed before processing caller input. |
| Reachability control | Remote attackers scanned and attempted exploitation against the endpoint. | Development tooling should not be directly reachable from untrusted networks. |
| Rapid vulnerability response | Observed activity followed only days after CVE publication. | Internet-facing Critical flaws require an emergency response path. |
| Post-exploitation containment | Compromised instances were used to deploy the Flodrix DDoS botnet. | Workload isolation and outbound controls limit what code execution can become. |
| Safe execution boundary | Decorator and default-argument payloads were compiled and executed in server context. | A validator must not give untrusted syntax an execution path or ambient host authority. |
| Evidence and recovery | The observed chain included reconnaissance, downloads, malware, and command and control. | Patching closes the route; investigation, credential rotation, and rebuild address prior access. |
Risk Severity and Response Priority
CVSS provides the technical severity of the flaw. Operational priority depends on the deployment. The same vulnerable version requires different actions depending on reachability, evidence of probing, available logs, and what the service identity can reach. This comparison turns those conditions into decisions.
| Deployment condition | Primary risk | Required response | Priority |
|---|---|---|---|
| Vulnerable and reachable from the internet | Unauthenticated RCE with active exploitation | Isolate immediately, preserve evidence, patch, hunt, and verify before restoration | Critical |
| Vulnerable, not public, reachable by broad internal networks | Internal compromise or stolen access can reach code execution | Restrict reachability, upgrade urgently, and test authentication and isolation | High |
| Patched after being public during April exploitation | Entry is closed, but prior compromise may remain | Review historical requests and process activity; rotate exposed secrets and rebuild if confidence is low | High |
| Version unknown or asset absent from inventory | Unmeasured exposure creates false assurance | Discover the asset, establish ownership, version it, and test the route from relevant network positions | High |
| Version 1.3.0 or later with restricted reachability | This CVE is remediated, but powerful execution paths remain | Verify the authentication dependency, least privilege, logging, egress policy, and future patch ownership | Ongoing |
Why This Matters for AI Tooling
Langflow sits in a category that organizations can easily misclassify. A visual builder may look like an internal experimentation tool rather than a server that needs production security controls. But the moment it listens on a network and accepts requests, its endpoints need the same authentication, authorization, logging, exposure review, and patching discipline as other applications.
AI tooling can also acquire connections quickly. A flow may call a model today and gain access to a data store or operational API tomorrow. That means a security review performed only when the tool is first installed will age badly. Governance has to follow the deployed system as its reachable data and actions change.
This is how blast radius grows without a formal architecture decision. A developer adds an API key to test a component. Another team connects a database. A container receives a broader service role because the first configuration fails. Each change is locally reasonable, but together they turn a builder into a control plane. When the application later has an RCE, the attacker receives the accumulated authority of every convenience decision.
The failure was not caused by an autonomous model making a novel decision. It was ordinary application security debt inside software used to build AI systems. That distinction matters because "AI security" cannot be reduced to model behavior, prompt injection, or alignment. The framework, API layer, Python runtime, container, identity, network, secret store, and update process are all part of the governed AI system.
Most importantly, validation is not a label that makes a component safe. The vulnerable route was named for code validation, yet it became the execution path. A control must itself be authenticated, constrained, logged, and tested. Otherwise the system's supposed gate can become its most direct way in.
This is also why a compliance artifact cannot substitute for runtime evidence. A design document may say the service is internal. A scan from the internet can prove otherwise. A ticket may say version 1.3.0 was deployed. A negative test can prove whether an unauthenticated caller is actually rejected. Governance becomes trustworthy when the assertion, the deployed state, and the evidence agree.
Coming up in Part 4 - six concrete actions to find exposure, contain compromise, and keep code-execution paths behind a real gate.
Part 4 of 4
Close the Window Before the Next Scan
What you missed: the critical gap was not only unsafe code handling. It was allowing an unknown remote caller to reach execution at all.
Six Actions for Defenders
Treat the Langflow incident as both a remediation task and a design review for every AI development platform in your environment.
Start with the exposed route, but do not stop there. The goal is to establish whether the service was reachable, whether it was vulnerable, whether anyone used the path, what authority the process held, and what evidence proves the restored state is safe.
Find every Langflow deployment
Inventory production, development, lab, container, and cloud instances. Include systems created by individual teams outside the normal application catalog. Reconcile CMDB records, container registries, cloud inventories, DNS, reverse proxies, and internet exposure results instead of trusting one source.
For each deployment, record the version, owner, network paths, service identity, mounted secrets, reachable dependencies, logging coverage, and last known exposure. "We do not run Langflow" is a claim to verify, especially when teams can launch open-source tools without central procurement.
Remove untrusted network reachability
Do not expose the service directly to the internet. Restrict access to approved users and systems through network controls and an authenticated gateway. Block the vulnerable route at the edge while full remediation is in progress, but treat that as containment rather than a permanent substitute for patching.
Test reachability from outside, from user networks, and from adjacent workloads. A firewall rule that protects one path can leave a direct container port, load balancer, alternate hostname, or cloud tunnel exposed.
Apply and verify the vendor remediation
Upgrade affected deployments to Langflow 1.3.0 or later, then verify the vulnerable endpoint can no longer be used without authorization. Trend Micro's patch analysis says version 1.3.0 added a CurrentActiveUser dependency to the route so FastAPI authenticates the request before the handler proceeds.
Exercise the negative case: an unauthenticated request must be rejected, an authenticated but unauthorized identity must not inherit unnecessary execution power, and the service must still be running the intended image after restart. An update ticket is not evidence that the deployed control works.
Investigate for exploitation
Review historical logs for POST requests to /api/v1/validate/code, especially across and after April 10-12, 2025. Correlate application requests with Python child processes, shell commands, reconnaissance, downloads into temporary paths, unusual outbound connections, and process or file self-deletion.
Use Trend Micro's published indicators as leads, not as the boundary of the hunt. Attack infrastructure and payloads change. If the host was reachable and evidence is incomplete, rotate credentials and rebuild from a known-good image rather than interpreting missing logs as proof that nothing happened.
Contain what the service can do next
Run AI tooling with a dedicated least-privilege identity, isolate it from sensitive systems, and restrict outbound connections. Separate build, test, and production integrations. Do not let a visual workflow server inherit a developer's ambient cloud permissions or a broad set of shared API keys.
Alert on the behavior the Flodrix chain required: unexpected shells, system profiling, access to new secrets, downloads from unapproved hosts, architecture-probing binaries, command-and-control traffic, and outbound DDoS patterns. These controls reduce the value of code execution if another flaw appears.
Create a same-day path for Critical internet-facing flaws
CVE publication, observed exploitation, and KEV status should trigger escalating response paths. For unauthenticated internet-facing RCE, do not make emergency isolation wait for the same approvals as a routine library update. Define who can remove exposure immediately, who owns the investigation, and who verifies remediation before access is restored.
Measure time to inventory, time to isolation, time to verified upgrade, and time to a compromise determination. The three-day disclosure-to-activity interval is a practical service-level objective test: if the organization cannot complete the first three steps inside that window, it needs compensating controls that can.
Governance Checklist
Can you prove that an exposed AI workflow service cannot turn an unknown request into host authority, and recover cleanly if prevention fails?
AuthorityGate 8-Gate Mapping
CVE-2025-3248 began at the identity boundary, but the observed campaign crossed every layer that follows: code inspection, host behavior, dependency reachability, incident ownership, and recovery. That is why "add authentication" is a necessary fix and an incomplete governance program.
The mapping below turns each gate into a concrete decision for this incident. Together, the gates make prevention independent, constrain post-exploitation movement, and leave evidence that tells responders whether the system is safe to restore.
Pre-Validation and Backup
Record the deployed version, configuration, reachable integrations, service identity, and a known-good recovery point before a change or emergency isolation begins.
ITSM Window Check
Open an emergency change window with a named owner, a deadline, and explicit authority to isolate exposed Langflow services without waiting for a normal release cycle.
Zero Trust Verification
Authenticate every caller before code validation, bind the request to a least-privilege identity, and deny the validation route from untrusted networks.
Security Scanning
Test the endpoint for decorator and default-argument payloads, inspect code before execution, and hunt for malicious POST requests, shell activity, and downloader artifacts.
Dependency Health
Map models, databases, secrets, plugins, APIs, containers, and cloud roles reachable from the Langflow host so code execution cannot inherit an invisible blast radius.
Behavioral Resilience
Block unexpected process launches, reconnaissance, remote downloads, new outbound destinations, and DDoS traffic even when application-layer prevention fails.
SME Approval
Require a named security owner to approve restoration only after the vulnerable route is authenticated, exposure is removed, compromise is investigated, and the fix is verified.
Recovery Readiness
Pre-stage host rebuilds, credential rotation, evidence preservation, egress containment, and a tested rollback so suspected compromise is handled as an incident, not only a patch.
Our Take
A Validation Endpoint Still Needs a Gate
Langflow's failure is a compact example of why validation must be layered. Checking submitted code is not enough when an unknown caller can reach the checker and turn it into an execution path. Identity, authorization, environment context, and intended effect all have to be validated before a consequential action runs.
The most important fix was small in code and large in meaning: version 1.3.0 made an active user dependency part of the route. The handler could no longer begin before FastAPI resolved the caller's identity. That is what fail-closed design looks like. Authority is established as a prerequisite, not inferred after processing has already started.
But identity alone does not answer what an authenticated request is allowed to execute, what the runtime can reach, whether a new process is consistent with the approved purpose, or whether a host exposed during active exploitation is clean. Those questions require independent gates and an accountable owner who can stop restoration when the evidence is incomplete.
AuthorityGate Keystone is designed around that separation. A proposed action does not become an executed action merely because one component accepts it. The change passes through independent gates, including security scanning, operational resilience checks, and accountable human approval, before it reaches production.
Sources
- Trend Micro: Langflow Vulnerability Exploited to Deliver Flodrix Botnet (primary campaign, exploit, patch, downloader, and malware analysis)
- SecurityWeek: Recent Langflow Vulnerability Exploited by Flodrix Botnet (independent reporting)
- Recorded Future: Langflow CVE-2025-3248 Active Exploitation (technical mechanism, exposure, and observed malicious activity)
- NIST NVD: CVE-2025-3248 (vulnerability record, publication date, weakness classes, and references)
- CISA: Known Exploited Vulnerabilities Catalog - CVE-2025-3248 (May 5, 2025 KEV record)
The April 10-12 exploitation observations are attributed to the SANS Internet Storm Center diary referenced by the reporting above.
The Bottom Line
CVE-2025-3248 put an unauthenticated remote caller one request away from arbitrary Python execution on a Langflow server. The CVE was published on April 7, exploitation attempts were observed from April 10 through April 12, CISA added it to the KEV catalog on May 5, and compromised instances were later used to deploy Flodrix.
The lesson is broader than one framework. AI development tools are applications with powerful execution paths, changing integrations, and real network exposure. They need ownership, inventory, authentication, isolation, rapid remediation, and evidence that every control works in the deployed environment.
The patch window was not a planning cycle. It was days. Organizations that can discover, isolate, remediate, and validate on that clock can contain the next flaw before it becomes someone else's infrastructure. Organizations that cannot are waiting for the scanner.
This article is part of our incident analysis newsletter series. Subscribe to receive complete analyses with timelines, risk tables, governance checklists, and actionable recommendations.
