Cyber

What changed

An OS command injection vulnerability has been identified in Kestra OSS, an open-source orchestration platform. This issue arises from the improper authentication mechanism in the AuthenticationFilter component, which allows unauthorized access to sensitive functionalities.

Specifically, prior to versions 1.0.45 and 1.3.21, the system uses a suffix match to determine access to the public configuration endpoint, which can be exploited by attackers.

Who is affected

The vulnerability impacts users of Kestra OSS, particularly those who have not updated to the latest versions. The following groups are at risk:

Organizations utilizing Kestra for event-driven orchestration without implementing additional security measures may find themselves exposed.

• Kestra OSS users prior to versions 1.0.45 and 1.3.21
• Developers relying on Kestra for workflow automation
• Companies implementing Kestra in production environments
• Security teams responsible for monitoring and securing orchestration platforms

What to do

It is crucial for affected users to take immediate action to mitigate the risk posed by this vulnerability. The following steps are recommended:

Upgrade to the latest versions of Kestra OSS to ensure that the vulnerability is patched and that the authentication mechanism is secured.

• Update Kestra OSS to version 1.0.45 or later, or 1.3.21 or later.
• Review and tighten access controls for the public configuration endpoint.
• Monitor for any unauthorized access attempts or unusual activity related to Kestra workflows.
• Consider implementing additional security measures, such as network segmentation or enhanced logging.

What changed

Langflow has released an important update to address a critical authorization bypass vulnerability. This flaw, identified as an Insecure Direct Object Reference (IDOR), existed in the /api/v1/responses endpoint, allowing authenticated attackers to manipulate flow IDs and access flows belonging to other users.

The vulnerability has been fixed in version 1.9.1, ensuring that user flows are protected against unauthorized access.

Who is affected

Organizations using Langflow prior to version 1.9.1 are at risk of this vulnerability, particularly those leveraging AI-powered agents and workflows.

Any authenticated user of Langflow could potentially exploit this flaw to access sensitive workflows belonging to other users.

• Langflow users operating versions before 1.9.1.
• Organizations deploying AI workflows through Langflow.
• Developers utilizing Langflow for building AI agents.

What to do

It is crucial for all users of Langflow to upgrade to version 1.9.1 immediately to mitigate the risk posed by this vulnerability. Regularly updating software and monitoring for security advisories can help maintain a secure environment.

Additionally, organizations should review their access controls and user permissions to ensure that unauthorized access is minimized.

• Upgrade Langflow to version 1.9.1 or later.
• Review and tighten access controls for user flows.
• Monitor for any suspicious activity related to flow access.