Remote Code Execution in BISHENG Workflow API

BISHENG versions prior to 2.6.0 contain a critical remote code execution vulnerability (CVE-2026-82278) located within the workflow run_once endpoint. An authenticated attacker can exploit this vulnerability by submitting a maliciously crafted Code node definition to the POST /api/v1/workflow/run_once endpoint. The application processes this payload using the Python exec() function without adequate sandboxing or input validation. Successful exploitation grants the attacker the ability to execute arbitrary Python code within the context of the application, leading to unauthorized access to the underlying filesystem, sensitive stored credentials, and internal network resources. Defenders should prioritize patching to version 2.6.0 or later to remediate the lack of process isolation.

Impact

Successful exploitation of CVE-2026-82278 results in complete loss of confidentiality, integrity, and availability for the BISHENG instance. Impact includes unauthorized access to system-level files, exfiltration of stored credentials used for workflow integrations, and potential lateral movement into the organization's internal network via the application's privileged network access.

Recommendation

• Upgrade BISHENG instances to version 2.6.0 or later immediately to resolve CVE-2026-82278.
• Audit logs for authenticated users accessing /api/v1/workflow/run_once to identify potential exploitation attempts.
• Restrict access to the BISHENG API to authorized users and networks via firewall or network access control lists.
• Implement monitoring for the exec() function or unusual child process spawns from the BISHENG application process if feasible within the environment.