Remote Code Execution in piflow DeepAgents

piflow versions 2.0.0 through 2.0.1 are affected by a critical remote code execution (RCE) vulnerability located within the DeepAgents chat agent component. The vulnerability arises because the POST /chat and POST /chat/stream endpoints lack authentication, allowing any unauthenticated remote user to interact with the agent. An attacker can manipulate the agent by instructing it to utilize the exec_shell tool. This tool executes arbitrary shell commands via Python's subprocess.run function without performing input validation, sanitization, or requiring human approval. Successful exploitation grants the attacker the ability to execute code with the permissions of the underlying web service, leading to full system compromise and the potential theft of sensitive environment variables, including LLM API keys and database credentials.

Impact

Successful exploitation of CVE-2026-109442 allows for unauthenticated remote code execution. This could lead to a complete compromise of the host server, unauthorized access to internal services, and the exfiltration of sensitive configuration data and API keys stored within the environment, impacting the security of any infrastructure managed or connected to the piflow instance.

Recommendation

• Upgrade piflow to a patched version beyond 2.0.1 immediately.
• Implement network-level access controls to restrict access to the piflow instance to trusted internal IP ranges until patching is complete.
• Audit environment variables and rotating secrets such as LLM API keys and database credentials if the instance was exposed to the internet.
• Monitor web server access logs for anomalous POST requests to the /chat and /chat/stream endpoints originating from untrusted sources.