Key points
- Piflow 2.0.0 and 2.0.1 have unauthenticated chat endpoints.
- Attackers can execute arbitrary commands via the exec_shell tool.
- No patch has been confirmed for this vulnerability yet.
Piflow versions 2.0.0 and 2.0.1 contain a critical remote code execution flaw. The vulnerability exists in the DeepAgents chat agent component. According to the National Vulnerability Database, the issue affects the POST /chat and POST /chat/stream endpoints. These endpoints lack authentication controls. Attackers can exploit this gap to run arbitrary commands on the server. No fix has been confirmed by the vendor yet.
In plain English
The DeepAgents chat agent in Piflow allows users to interact with AI models. The system includes a tool called exec_shell that runs system commands. This tool does not require human approval or an allow-list. Attackers can instruct the agent to use this tool through the chat endpoints. Because the endpoints are open, anyone can send these instructions. The system then executes the commands using subprocess.run. This exposes environment secrets like API keys and database credentials.
The background
The flaw is tracked as CVE-2026-109442. The National Vulnerability Database rates it as critical with a CVSS score of 9.3. The weakness is classified under CWE-306 for authentication failure. The vulnerability affects Piflow software developed by cas-bigdatalab. It specifically targets versions up to 2.0.1. The issue stems from missing authentication on specific API endpoints. This allows remote attackers to bypass security checks entirely.
What changes now
Organizations using Piflow must verify their installed versions immediately. If running 2.0.0 or 2.0.1, the system is vulnerable. Teams should check network logs for unusual activity on the chat endpoints. Since no patch exists, exposure must be reduced manually. Administrators should restrict access to the affected endpoints. Monitoring for unauthorized command execution is essential. Waiting for a vendor update is not a safe strategy.
Who needs to act first
Teams usually prioritize systems exposed to the internet or untrusted networks. Check whether your Piflow instances are accessible without network restrictions. Isolate vulnerable servers from sensitive data sources immediately. Back up configuration files before making changes. Test any temporary mitigation in a non-production environment first. Reduce exposure by blocking external traffic to the chat endpoints until a fix is available.
What to do and how to stay safe: Piflow
- Verify if your Piflow installation is version 2.0.0 or 2.0.1.
- Restrict network access to the POST /chat and POST /chat/stream endpoints.
- Monitor logs for attempts to use the exec_shell tool.
- Contact the vendor for updates on a security patch.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Piflow versions are affected by CVE-2026-109442?
Versions 2.0.0 through 2.0.1 of Piflow are affected.
Is there a patch available for this vulnerability?
No fix has been confirmed by the vendor yet.
What can attackers do with this flaw?
Attackers can run arbitrary commands and access environment secrets.
