CVE-2026-109442

9.8Critical

Published 20 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash

9.8Critical

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-306

Impact

Unauthenticated attackers can execute arbitrary shell commands on the host by sending requests over the network. This allows full host takeover and theft of environment secrets like API keys and database credentials.

Root cause

The /chat and /chat/stream endpoints lack authentication, allowing remote callers to invoke an unrestricted exec_shell agent tool that passes input directly to subprocess.run.

Affected systems

piflow 2.0.0 through 2.0.1

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

No fixed version is listed in the advisory. Block external network access to the /chat and /chat/stream endpoints at your reverse proxy or firewall immediately, or take the piflow service offline.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

piflow 2.0.0 through 2.0.1 contains a remote code execution vulnerability in its DeepAgents chat agent, whose POST /chat and POST /chat/stream endpoints lack authentication. Attackers can instruct the agent to call the exec_shell tool, which runs arbitrary commands via subprocess.run without human approval or an allow-list, exposing environment secrets such as LLM API keys and database credentials.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109442