Langflow PythonREPLComponent Unsandboxed Code Execution (CVE-2026-10561)

let langflowParents = dynamic(["python","python3","uvicorn","gunicorn","langflow"]);
let suspiciousChildren = dynamic(["sh","bash","zsh","dash","nc","ncat","netcat","curl","wget","whoami","id","uname","cmd.exe","powershell.exe","pwsh.exe"]);
DeviceProcessEvents
| where InitiatingProcessFileName has_any (langflowParents)
    and (InitiatingProcessCommandLine has "langflow" or InitiatingProcessCommandLine has "uvicorn")
| where FileName has_any (suspiciousChildren)
| where ProcessCommandLine has_any ("-c","/dev/tcp","base64","socket","subprocess","os.system","exec(","reverse","bash -i")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, ReportId
| order by Timestamp desc

index=edr sourcetype="process:events"
| where (like(parent_process_name,"%python%") OR like(parent_process_name,"%uvicorn%") OR like(parent_process_name,"%gunicorn%")) AND (like(parent_process,"%langflow%") OR like(parent_process,"%uvicorn%"))
| where (process_name IN ("sh","bash","zsh","dash","nc","ncat","curl","wget","whoami","id","uname") OR like(process_name,"%powershell%") OR like(process_name,"%cmd.exe%"))
| where match(process,"(-c|/dev/tcp|base64|socket|subprocess|os\.system|exec\(|reverse|bash -i)")
| table _time, host, user, parent_process_name, parent_process, process_name, process
| sort - _time

process where event.type == "start" and
  process.parent.name in ("python","python3","uvicorn","gunicorn") and
  (process.parent.command_line : "*langflow*" or process.parent.command_line : "*uvicorn*") and
  process.name in ("sh","bash","zsh","dash","nc","ncat","curl","wget","whoami","id","uname","powershell.exe","cmd.exe") and
  process.command_line : ("*-c*","*/dev/tcp*","*base64*","*socket*","*subprocess*","*os.system*","*exec(*","*reverse*","*bash -i*")

SELECT QIDNAME(qid) AS event, "Process Name" AS process, "Parent Process Name" AS parent, "Command Line" AS cmdline, username, sourceip, devicetime
FROM events
WHERE ("Parent Process Name" ILIKE '%python%' OR "Parent Process Name" ILIKE '%uvicorn%' OR "Parent Process Name" ILIKE '%gunicorn%')
AND ("Command Line" ILIKE '%langflow%' OR "Command Line" ILIKE '%uvicorn%')
AND ("Process Name" ILIKE '%sh' OR "Process Name" ILIKE '%nc%' OR "Process Name" ILIKE '%curl%' OR "Process Name" ILIKE '%wget%' OR "Process Name" ILIKE '%whoami%' OR "Process Name" ILIKE '%powershell%')
AND ("Command Line" ILIKE '%/dev/tcp%' OR "Command Line" ILIKE '%base64%' OR "Command Line" ILIKE '%subprocess%' OR "Command Line" ILIKE '%os.system%' OR "Command Line" ILIKE '%bash -i%' OR "Command Line" ILIKE '%reverse%')
ORDER BY devicetime DESC LAST 24 HOURS

_sourceCategory=*endpoint* (langflow OR uvicorn)
| where (parent_process matches /(?i).*(python|uvicorn|gunicorn).*/) and (parent_cmdline matches /(?i).*(langflow|uvicorn).*/)
| where (process_name matches /(?i)(sh|bash|zsh|dash|nc|ncat|curl|wget|whoami|id|uname|powershell|cmd)/)
| where (cmdline matches /(?i).*(-c|\/dev\/tcp|base64|socket|subprocess|os\.system|exec\(|reverse|bash -i).*/)
| fields _messagetime, host, user, parent_process, process_name, cmdline
| sort by _messagetime desc

rule langflow_pythonrepl_rce_cve_2026_10561 {
  meta:
    author = "argus"
    description = "Langflow PythonREPLComponent unsandboxed RCE (CVE-2026-10561)"
    severity = "CRITICAL"
  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    re.regex($e.principal.process.parent_process.file.full_path, `(?i)(python|uvicorn|gunicorn)`)
    re.regex($e.principal.process.parent_process.command_line, `(?i)(langflow|uvicorn)`)
    re.regex($e.target.process.file.full_path, `(?i)(sh|bash|nc|ncat|curl|wget|whoami|id|uname|powershell|cmd)`)
    re.regex($e.target.process.command_line, `(?i)(-c|/dev/tcp|base64|socket|subprocess|os\.system|exec\(|reverse|bash -i)`)
  condition:
    $e
}

#event_simpleName=ProcessRollup2
| ParentBaseFileName=/python|uvicorn|gunicorn/i
| ParentCommandLine=/langflow|uvicorn/i
| FileName=/^(sh|bash|zsh|dash|nc|ncat|curl|wget|whoami|id|uname|powershell\.exe|cmd\.exe)$/i
| CommandLine=/(-c|\/dev\/tcp|base64|socket|subprocess|os\.system|exec\(|reverse|bash -i)/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, ParentCommandLine, FileName, CommandLine])