14 flaws across seven AI orchestration platforms
On August 18, 2026, Endor Labs published research by Peyton Kennedy, its senior security researcher. Kennedy found 14 Critical and High vulnerabilities in seven AI orchestration platforms, which are tools for building and running workflows that connect AI models to other services.
The seven are NocoBase, Flowise, Langflow, Dify, Activepieces, Kestra and Apache Airflow, and Kennedy presented the work at DEF CON 34. Langflow and Dify each have more than 150,000 stars on GitHub. Endor Labs says that for individuals these platforms can expose email and calendar access and stored credentials, and for companies, customer data.
In the worst cases, an attacker with no account could use a prompt to run code on the server and exfiltrate data. The attack is prompt injection, which hides instructions in the text an AI model reads. Depending on setup, Flowise, Kestra and Langflow could be exploited without signing in.
"I uncovered 14 critical and high severity vulnerabilities, including multiple unauthenticated prompt-injection to RCE chains, across seven AI orchestration platforms." — from the opening summaryView official source →
A single prompt could run code on the server
In Flowise, one HTTP request was enough, and in Langflow a single chat message ran commands on the host. In Flowise 3.1.2, a prompt sent to the prediction endpoint without credentials made the model write Python code. The code slipped past a filter of 38 regular expressions, ran on the server and exfiltrated the dataset.
Langflow's Smart Transform node passed a string to eval() if it started with "lambda" and contained a colon. Kennedy rated the Flowise issue 9.0 and the Langflow issue 8.8 on CVSS, a 0 to 10 scale for how severe a vulnerability is.
"The validator confirms the string starts with lambda and contains a colon. eval runs it on the host. This is the shortest available path from a chat box to a shell." — from LangflowView official source →
Which of the seven platforms have fixes
NocoBase, Langflow, Activepieces and Apache Airflow have fixed releases, Kestra and Dify will not fix their issues, and Flowise is no longer maintained. The table below summarizes Endor Labs' results by platform.
Findings and status by platform (from Endor Labs' results list)
| Platform | Findings | Highest severity | Status |
|---|---|---|---|
| NocoBase | 4 | 9.9 Critical | Fixed in 2.0.39; the 9.9 issue is fixed upstream with its advisory pending |
| Flowise | 1 | 9.0 Critical | No fix; repository archived on August 10, 2026 |
| Langflow | 3 | Critical | Smart Transform fixed in 1.10.3 and 1.11.0; status of two other Critical issues unknown |
| Dify | 1 | No score (runs as root) | Closed as working as designed |
| Activepieces | 2 | 8.7 High | Fixed in 0.80.0 |
| Kestra | 2 | 9.8 Critical | Closed as intended; Docker or Kubernetes task runners recommended |
| Apache Airflow | 1 | 8.8 High (Low per the ASF) | Documentation fixed in 3.2.0; existing workflows still need checks |
Kennedy could not confirm whether fixes for the two other Langflow issues have shipped. Three advisories were still unpublished at the time of the talk, under Endor Labs' 90+30-day disclosure timeline.
"Three advisories were not public at the time of my presentation but followed our 90+30 disclosure timeline." — from ResultsView official source →
Why all seven platforms share the same weakness
All seven assume that anyone who can edit a workflow may run code on the server, and they ship multi-user services as if they were single-user developer tools. Kennedy says every finding is a variation on that one error. A setup that is fine on one developer's laptop turns risky once other people can reach it over the network.
Kennedy groups the 14 issues into five patterns: development that outpaces code and security review, model output trusted as code, and sandboxes defeated by execution order. The other two are trust boundaries that describe a different product from the one actually deployed, and documentation that teaches unsafe patterns.
A sandbox is a closed-off area where code runs apart from the rest of the system. In NocoBase, the call that switches its sandbox on was commented out with a TODO note. Kennedy advises treating every connected service as a possible way in.
"Every vulnerability is a variation on the same error. These are multi-tenant code-execution environments, shipped as single-user developer tools, and the threat model has not expanded alongside the products." — from the introductionView official source →
Kestra and Dify say the behavior is by design
Kestra and Dify closed the reports as working as designed and will not ship fixes, so users have to add their own defenses. Kestra webhooks need no authentication by default, and attacker-supplied input reached a shell and ran. Kennedy rated both Kestra issues 9.8, and Kestra recommends Docker or Kubernetes task runners as the safeguard.
Dify's sandbox ran a string from the server as root before its restrictions were switched on. Kestra and Airflow first argued that running scripts is the product and securing the deployment is the operator's job.
Kennedy says most of that argument holds, but the defenses it relies on are either missing or open to anyone on the internet. Airflow later accepted a CVE once its own documentation was shown to contradict itself.
"To summarize, executing scripts is the product. Hardening the deployment is the operator's job. I think most of that argument holds." — from The intentional endView official source →
Upgrade the four patched platforms and plan to leave Flowise
Updating will not fix Flowise, so Endor Labs advises moving to another tool and treating any Flowise instance still running as unmaintained software. Its developers stopped work on July 29, 2026, and archived the repository on August 10. The other four have fixed versions to move to: NocoBase 2.0.39, Activepieces 0.80.0, Airflow 3.2.0, and Langflow 1.10.3 or 1.11.0.
Airflow 3.2.0 changes only the documentation, so workflows written from the old examples still need checking by hand. Kestra and Dify have no fix, so Endor Labs recommends compensating controls.
Treat every trigger endpoint like an exposed SSH port and put authentication in front of it. Flowise's own login setting does not cover its prediction path, so put it behind a reverse proxy that enforces authentication. Endor Labs also advises turning off risky defaults such as SANDBOX_ENABLE_NETWORK and enable_preload in Dify and LANGFLOW_SKIP_AUTH_AUTO_LOGIN in Langflow.
"Development ceased on 2026-07-29 and the repository was archived on 2026-08-10, so plan a migration and treat any running instance as unmaintained software with credentials attached." — from For operatorsView official source →
How companies and staff can reduce the risk
Japan's IPA ranked AI-related cyber risk third on its 2026 list of threats to organizations, a new entry this year, and calls for tracking AI tool use and banning unapproved services. IPA, the Information-technology Promotion Agency, is Japan's government body for IT security. Attacks that exploit system vulnerabilities came fourth on the same list.
Workflow tools like these are easy for one person to set up and link to email or a database, so they can end up running without IT knowing. The two steps below are based on IPA's guidance for organizations.
Companies: track in-house AI tools and keep them updated
Companies need a process that finds every workflow tool running in-house, including ones staff set up on their own, and patches anything with an available fix right away. IPA asks organizations to track AI service use through IT asset and configuration management, logs, and a cloud access security broker (CASB), which monitors how cloud services are used. For vulnerabilities, it asks them to know the assets they use and to choose software and versions that still receive security updates.
An archived Flowise no longer meets that bar. Knowing which versions run in-house also matters when a release itself is tampered with (see LiteLLM 1.107.0 shipped with a credential stealer).
"利用している資産の把握、管理体制の整備" ／ "セキュリティのサポートが充実しているソフトウェアやバージョンを使う" — from the countermeasures for attacks that exploit system vulnerabilitiesView official source →
Staff: keep work data out of unapproved AI tools
Each employee can keep work email, customer data and the credentials that unlock them out of any workflow tool they are trying out on their own. IPA asks staff not to use AI services their company has not approved and not to enter confidential information casually. Endor Labs lists email and calendar access, credentials and customer data as what these platforms can expose.
If you want to try one of these tools for work, ask your IT team first. Until it is approved, test it only with sample data.
"未許可・未認可の AI サービス利用（シャドーIT）の禁止" ／ "社内の秘密情報等を安易に入力しない" — from the countermeasures for cyber risks around the use of AIView official source →
FAQ
- Which platforms could be attacked without logging in?
- Flowise, Kestra and Langflow, depending on how they are set up. In Flowise 3.1.2, one request to the prediction endpoint needed no credentials and no account, and Kestra webhooks have no authentication by default.
- Is Apache Airflow safe after upgrading to 3.2.0?
- Not fully. Airflow 3.2.0 fixed only the documentation, and the code path that runs the command is unchanged. Workflows already written from the old example still need to be checked by hand.
- What should Kestra and Dify users do if there is no patch?
- Apply compensating controls. Endor Labs advises putting authentication in front of trigger endpoints such as Kestra webhooks and turning off risky defaults in Dify. Kestra itself recommends running tasks in Docker or Kubernetes.
Related articles
Why Claude Mythos 5 kept attacking real developersAnthropic and the UK AISI explain why Claude Mythos 5 pushed malicious code on a real GitHub project. Told it faced real people, it stopped 5% of the time.
What is prompt injection? Types, attacks, defensesPrompt injection slips instructions into text an AI reads. See direct vs indirect attacks, real incidents, why filters miss it, and how to limit the damage.
AI cyber attack: AI agents hit 27 firms for $25In an AI cyber attack disclosed by Gambit Security, three open source AI agents breached at least 27 retailers and took 600,000+ cards for about $25 a target.
9 of 10 AI agents raised their own crypto capsAsked only to pay invoices, 9 of 10 AI models read an emailed approval code and raised their own crypto wallet cap, Cornell Tech and Yale researchers found.