Self-Hosted AI & Data Tools Exploited: Langflow, LiteLLM, Metabase, Kestra, MLflow, Ray (2026)

Published 2026-10-08 · Last updated 2026-10-08

Why these keep getting hit

These platforms are usually deployed fast, from a docker run in a README, often on a cloud VM with a public IP, and many ship with authentication off or minimal by default. They also tend to hold API keys for paid services (OpenAI, Anthropic, cloud accounts) and database credentials. Attackers scan for them specifically, either to steal those keys or to mine crypto on the server.

Affected and fixed versions

Product	CVE	What it is	Upgrade to
Langflow	CVE-2026-9198	/api/v1/auto_login mints superuser tokens for any caller; chained with /api/v1/validate/code (runs code via exec()) = unauthenticated RCE on default installs. 1.0.0–1.10.0.	Newer than 1.10.0 (see IBM advisory)
Langflow	CVE-2026-0770	exec_globals on the validate endpoint → unauthenticated code execution as root.	1.9.0+
Langflow	CVE-2026-55255	IDOR on /api/v1/responses: run another user’s flow.	1.9.1+
LiteLLM	CVE-2026-42271	MCP “test connection” endpoints accept a stdio command and run it (authenticated).	1.83.7+
LiteLLM	CVE-2026-59822	Fake Authorization header triggers an OAuth2 fallback that skips key validation on the MCP endpoint.	1.84.0+
Metabase	CVE-2026-72898	SQL injection in /reset_password → admin, no login. CVSS 10.	x.58.24, x.59.21, x.60.17, x.61.11, x.62.9, x.63.5 or later
Kestra OSS	CVE-2026-49869	Auth filter allowlists any path ending in /configs → whole API without auth → RCE.	1.0.45 / 1.3.21+
MLflow	CVE-2026-64849	Unauthenticated webhook test endpoint follows redirects → full-read SSRF (cloud metadata, internal services).	3.15.0+
Ray	CVE-2025-62593	Dashboard/API guarded only by a User-Agent check → a malicious web page in Firefox/Safari can run code on a developer’s Ray via DNS rebinding.	2.52.0+
Starlette	CVE-2026-48710	Host header rebuilds request.url, so path-based security checks in middleware see a different path than the router. Affects any FastAPI/Starlette app relying on request.url.path for auth.	1.0.1+

Am I affected?

# Which of these are running in Docker?
docker ps --format '{{.Image}}\t{{.Ports}}' | grep -iE 'langflow|litellm|metabase|kestra|mlflow|rayproject'

# Python environments
pip show langflow litellm mlflow ray starlette 2>/dev/null | grep -E '^(Name|Version)'

Metabase shows its version under Admin → Troubleshooting or at /api/session/properties (version.tag). Kestra shows it in the UI footer.

And the most important check: is it reachable from the internet? Look at the Ports column. Anything bound to 0.0.0.0 on a public host is exposed, regardless of firewall assumptions. Docker port publishing bypasses UFW by default.

How to patch

# Docker Compose: bump the tag (avoid :latest pins that never re-pull), then
docker compose pull && docker compose up -d

# pip installs
pip install -U langflow litellm mlflow ray starlette

For Starlette, update the framework in every FastAPI app you deploy and rebuild the images. It’s a library, so it’s inside your containers, not on the host.

Hardening

• Bind to localhost or a private network (-p 127.0.0.1:7860:7860) and put an authenticating reverse proxy in front: Caddy with forward_auth to Authelia/Authentik, or a VPN. See our Caddy reverse proxy guide.
• Langflow: set LANGFLOW_AUTO_LOGIN=false and configure a superuser. Auto-login is what makes CVE-2026-9198 unauthenticated.
• LiteLLM: set a strong LITELLM_MASTER_KEY and keep the admin UI off the internet.
• Ray: never expose the dashboard (port 8265) or GCS port; Ray has no built-in auth.
• Rotate API keys stored in any of these tools if they were exposed on a vulnerable version. Stolen LLM keys get resold and run up huge bills.

Sources

• Langflow: IBM advisory (CVE-2026-9198), ZDI-26-036, GHSA-qrpv-q767-xqq2
• LiteLLM: GHSA-v4p8-mg3p-g94g, GHSA-7488-6r32-c95q
• Metabase GHSA-vwf4-m7j8-wcjf · Kestra GHSA-5vc5-wxxq-3fjx · MLflow GHSA-7gwp-5pfp-969j · Ray GHSA-q279-jhrf-cc6v · Starlette GHSA-86qp-5c8j-p5mr
• CISA Known Exploited Vulnerabilities catalog

← Back to Knowledge Base