Peyton Kennedy, a senior security researcher at Endor Labs, published a report on August 18, 2026 documenting 14 critical and high severity vulnerabilities across seven open source AI orchestration platforms, according to the report: NocoBase, Flowise, Langflow, Dify, Activepieces, Kestra and Apache Airflow. Magica's review of the public advisories found that six of the 14 are backed by public records, spanning Flowise, Langflow, Activepieces and NocoBase, while three had no public advisory at the time Kennedy presented the work and Dify and Kestra were closed by their vendors as working as designed. The research resurfaced after CYBR.SEC.Media published a writeup on October 28, 2026 based on a podcast interview in which Kennedy said the work was presented at DEF CON 34.
Why It Matters to Engineers Building Agents
These seven platforms sit in the same spot many agent stacks put a workflow engine: wired to cloud credentials, production databases and internal APIs, reachable over a webhook, and fed documents or messages an engineer did not write. Kennedy's report frames the problem as architectural: every platform tested inherited the assumption that anyone who can touch a workflow is trusted to run code on the host, an assumption that holds for a developer tool run by one engineer but not for a multi-tenant service an unauthenticated webhook can reach. Magica's analysis frames the practical question for an operator as which endpoints can start a flow without authentication, which roles can author or edit code-capable steps, and what executes during compilation or module loading before isolation is active, a checklist that applies equally to a team's own agent code.
Key Takeaways
The report covers 14 findings across NocoBase, Flowise, Langflow, Dify, Activepieces, Kestra and Apache Airflow, audited across four languages, ranging from an accidental sandbox escape to command execution shipped by design.
In Flowise, the CSV Agent and Airtable Agent nodes through version 3.1.2 passed LLM-generated Python through a 38-pattern blocklist before Pyodide executed it, reachable through an unauthenticated prediction API; demonstrated effects were data exfiltration and server-side request forgery through URL-capable pandas functions. The affected nodes were removed in 3.1.3, and Endor Labs says the project has since ceased development and archived its repository.
Langflow's Smart Transform component, versions 1.3.0 through 1.10.2, accepted any string that merely started with "lambda" and contained a colon and evaluated it with Python's full builtins; Langflow shipped AST validation and restricted builtins in 1.11.0, with a 1.10.3 backport.
Activepieces had two separate issues: in SANDBOX_CODE_ONLY mode through 0.79.4, a module-loading function executed top-level code before the exported function was serialized into an isolate, and a separate flaw let shell metacharacters in a Code step's name execute commands during compilation, before any sandbox activated; both are fixed in 0.80.0.
NocoBase's two advisories, both patched in 2.0.39, involved a missing SQL-validation guard on an update endpoint and a recursive eager-loading query that joined string primary keys without parameter binding; both require an account that already has collection-management or record-creation permission, not an unauthenticated attacker.
Details
Kennedy's original report describes the seven platforms as having "quietly become critical infrastructure" in CI/CD pipelines, data workflows and agentic stacks, shipped as containers that bind to a port and put a webhook on the front. Magica's account adds that the 14-count combines different exposure levels rather than one shared risk: the public advisories describe an unauthenticated prompt-injection path in Flowise, a flow-author-triggered code evaluation gap in Langflow, two timing failures in Activepieces where code ran before isolation took effect, and two permission-gated SQL issues in NocoBase. Apache Airflow's listed 3.2.0 change is documentation-only, according to Magica's reading of the report, and existing DAGs built on the unsafe BashOperator pattern still need review.
The CYBR.SEC.Media account reports that Kennedy encountered maintainers who viewed some of the reported behavior as intentional, arguing the platforms are built to execute code and that securing a deployment is the operator's responsibility. In Kestra, the article reports that webhook-triggered workflows could pass attacker-supplied values into shell execution.
What is not established in any of the three accounts: whether any of the 14 findings were exploited against a live deployment before Kennedy's disclosure, a complete list of CVE or GHSA identifiers covering every finding, or a public remediation status for the Dify and Kestra items beyond the vendors' "working as designed" response reported by Magica.
Industry Insight and Commentary
The following is analysis, not reporting. The pattern across these findings, a tool built for one trusted operator at a keyboard later deployed as a networked service an agent can reach through a document or a webhook, is a mismatch that recurs whenever a developer tool's threat model is not revisited once it starts receiving untrusted input indirectly, through retrieved content rather than a direct request. A scoped, short-lived credential issued per workflow run, rather than a standing key with broad database access, would narrow what an attacker reaches even if a prompt injection succeeds, and validating generated code against what it is allowed to do, rather than what it is shaped like, would remove the specific bypass behind the Flowise and Langflow findings; neither is a claim about what any platform should have built, only a reasoned possibility based on where these chains broke down.
What This Means on Solari
The findings above describe code evaluation running inside a shared interpreter or process, with no boundary scoped to the one run that submitted it. Solari's AI Sandboxes run agent-generated code as an isolated Linux machine, with a hardened isolation tier that blocks all outbound network, so a run that should not reach the internet at all can be configured not to. An engineer wiring a code-execution step into an agent pipeline picks that isolation level per sandbox, rather than relying on a pattern-matching filter in front of a shared interpreter.
What to Watch
Whether Dify and Kestra revise their "working as designed" position as more teams run agents against these platforms over a network, and whether teams running NocoBase, Flowise and Apache Airflow on affected versions complete upgrades given that Flowise itself is no longer maintained, are the next facts to confirm.
