{"id":"CVE-2026-109442","kind":"vulnerability","aliases":["CVE-2026-109442"],"related":[],"title":"piflow DeepAgents chat: unauthenticated endpoints run shell commands, expose secrets","description":"piflow 2.0.0 through 2.0.1 contains a remote code execution vulnerability in its DeepAgents chat agent, whose POST /chat and POST /chat/stream endpoints lack authentication. Attackers can instruct the agent to call the exec_shell tool, which runs arbitrary commands via subprocess.run without human approval or an allow-list, exposing environment secrets such as LLM API keys and database credentials.","summary":"piflow 2.0.0 through 2.0.1 has POST /chat and POST /chat/stream endpoints with no authentication, and the DeepAgents agent behind them can call an exec_shell tool. An attacker who sends a prompt can make the agent run arbitrary shell commands and read environment variables such as LLM API keys and database credentials.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"piflow","fixed":[],"affected":">= 2.0.0, <= 2.0.1","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["ai-agents","ai-tooling","deepagents","piflow","rce","self-hosted","unauthenticated"],"not_affected_if":["endpoints-behind-auth-proxy","versions-outside-2.0.0-2.0.1"],"how_to_check":"Check the deployed tag/commit: v2.0.0 (f3b421c) and v2.0.1 (ad8d010) are affected. Then test: curl -i -X POST http://<host>:<port>/chat -H 'Content-Type: application/json' -d '{\"message\":\"hi\"}'. Any answer without credentials means exposed. Also check /chat/stream and /workspace/upload, and whether the service is published beyond localhost (it binds 0.0.0.0 by default).","fix":"No patched release as of 2026-10-23 (v2.0.1 is the latest). Mitigate: take the server off untrusted networks or put an authenticating reverse proxy in front of /chat, /chat/stream and /workspace/upload; remove exec_shell from the agent's tools (agents/factory.py) or gate it with interrupt_on; stop passing the full os.environ to the child; bind to 127.0.0.1; restrict CORS. Rotate LLM API keys and DB credentials if the service was reachable.","status":"open","published_at":"2026-10-20T01:17:10+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","triaged_at":"2026-10-23T22:39:45+00:00","updated_at":"2026-10-23T22:41:52+00:00","category":"ai-tooling","confidence":0.85,"triage":{"at":"2026-10-23T22:39:45Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"piflow DeepAgents chat: unauthenticated endpoints run shell commands, expose secrets","impact":"high","summary":"piflow 2.0.0 through 2.0.1 has POST /chat and POST /chat/stream endpoints with no authentication, and the DeepAgents agent behind them can call an exec_shell tool. An attacker who sends a prompt can make the agent run arbitrary shell commands and read environment variables such as LLM API keys and database credentials.","category":"ai-tooling","who_cares":["piflow","deepagents","self-hosted","ai-agents"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker runs shell commands on the server and reads environment secrets.","analyst_note":"Fixed version and vendor patch status are not in the sources; check the NVD entry and the piflow repository for a release after 2.0.1.","how_to_check":"Check whether the piflow version is 2.0.0 or 2.0.1, e.g. inspect the deployed package or image tag.\nSend an unauthenticated request to POST /chat on the piflow host and see whether it answers.\nunknown","needs_analyst":true,"not_affected_if":["versions-outside-2.0.0-2.0.1","endpoints-behind-auth-proxy"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000549,"input_tokens":3029,"output_tokens":493,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Fixed version and vendor patch status are not in the sources; check the NVD entry and the piflow repository for a release after 2.0.1.","search":"'-109442':13A,16A '-2026':12A,15A '/chat':37B,100C '/chat/stream':40B,103C '2.0.0':32B,84C '2.0.1':34B,86C 'agent':20B,48B,66B,97C,111C 'ai':19B,22B 'ai-ag':18B 'ai-tool':21B 'allow':130C 'allow-list':129C 'api':78B,138C 'approv':126C 'arbitrari':68B,120C 'attack':58B,107C 'authent':44B,106C 'behind':49B 'call':52B,113C 'chat':3A,96C 'code':90C 'command':8A,70B,121C 'contain':87C 'credenti':82B,142C 'cve':11A,14A 'databas':81B,141C 'deepag':2A,24B,47B,95C 'endpoint':5A,41B,104C 'environ':73B,133C 'exec':54B,115C 'execut':91C 'expos':9A,132C 'host':29B 'human':125C 'instruct':109C 'key':79B,139C 'lack':105C 'list':131C 'llm':77B,137C 'make':64B 'piflow':1A,17A,25B,31B,83C 'post':36B,39B,99C,102C 'prompt':62B 'rce':26B 'read':72B 'remot':89C 'run':6A,67B,119C 'secret':10A,134C 'self':28B 'self-host':27B 'send':60B 'shell':7A,55B,69B,116C 'subprocess.run':123C 'tool':23B,56B,117C 'unauthent':4A,30B 'variabl':74B 'via':122C 'vulner':92C 'whose':98C 'without':124C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T01:17:10+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109442","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109442","severity":null,"published_at":"2026-10-20T01:17:10+00:00","modified_at":"2026-10-20T20:11:29+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-109442:230","url":null,"severity":null,"published_at":"2026-10-23T22:28:40+00:00","modified_at":"2026-10-23T22:28:40+00:00","first_seen_at":"2026-10-23T22:28:40+00:00","fetched_at":"2026-10-23T22:28:40+00:00","note":"Lasso (finder) and VulnCheck advisories read; no fixed piflow release exists (v2.0.1 is latest on GitHub releases, no vendor advisory). Endpoints are on by default: /chat and /chat/stream are registered unconditionally, no auth, bind 0.0.0.0, CORS *. No known exploitation (Lasso, EUVD: not KEV, EPSS 0.69%); only a request shape is described, not a public PoC."},{"source":"analyst","external_id":"CVE-2026-109442:277","url":null,"severity":null,"published_at":"2026-10-23T22:41:52+00:00","modified_at":"2026-10-23T22:41:52+00:00","first_seen_at":"2026-10-23T22:41:52+00:00","fetched_at":"2026-10-23T22:41:52+00:00","note":"Rechecked: latest piflow release is still v2.0.1 (2026-07-31); no fix. No new documents. Re-applied fix and how-to-check, which the later triage pass had blanked."}],"documents":[{"id":1471,"url":"https://www.lasso.security/vulnerability-database/cve-2026-109442","title":"Lasso: CVE-2026-109442 piflow unauthenticated RCE via chat agent","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1472,"url":"https://www.vulncheck.com/advisories/piflow-2.0.0-through-2.0.1-unauthenticated-rce-via-chat-agent-exec-shell","title":"VulnCheck advisory: piflow 2.0.0-2.0.1","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1473,"url":"https://github.com/cas-bigdatalab/piflow/releases","title":"piflow releases (latest v2.0.1)","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}