All posts
Unproven Execution

JADEPUFFER: Langflow's Anonymous exec() Meets an Agent

Sysdig documented an LLM-driven end-to-end ransomware operation entering via Langflow's pre-auth exec endpoint and harvesting bundled machine identities

Securityv0 Intelligence Team OWASP: ASI05 sv0 finding: unproven_execution
langflow jadepuffer agentic-ransomware unproven-execution nhi nacos

The Incident

On 2026-07-01, Sysdig’s Threat Research Team published its analysis of JADEPUFFER, an operation Sysdig assesses as the first documented end-to-end LLM-driven ransomware attack. Initial access came via CVE-2025-3248 (CVSS 9.8), a missing-authentication remote code execution flaw in Langflow’s /api/v1/validate/code endpoint that was patched in Langflow 1.3.0 on 2025-03-31 and added to CISA’s Known Exploited Vulnerabilities catalog on 2025-05-05 with an FCEB remediation deadline of 2025-05-26. The target Langflow host was still exposed.

Once inside, the LLM-driven agent enumerated the host and harvested credentials for OpenAI, Anthropic, DeepSeek, and Gemini API accounts, together with cloud tokens for Alibaba/Aliyun, Tencent, Huawei, AWS, GCP, and Azure. It then used previously-reachable MySQL root credentials to pivot to a production Alibaba Nacos configuration service, exploited CVE-2021-29441 (a Nacos authentication bypass) to create a rogue administrator, and — when its first bcrypt-hashed admin account failed to log in — diagnosed the cause and issued a working corrective payload 31 seconds later. It then encrypted 1,342 Nacos configuration items in place using MySQL’s built-in AES_ENCRYPT() function and dropped the originals, leaving behind a README_RANSOM table pointing to a Bitcoin address and a Proton Mail contact. The ransom note claimed AES-256, but MySQL’s AES_ENCRYPT() defaults to AES-128-ECB — a mismatch the agent did not catch. The encryption key was two concatenated UUID4 values, printed once to stdout and never persisted or transmitted; recovery is impossible even if a victim pays.

Sysdig cites more than 600 payloads across the operation carrying plain-language reasoning comments as evidence of LLM authorship. In TechCrunch’s follow-up, Sysdig’s Michael Clark bounded the autonomy claim: a human still chose the target and directed the campaign, but not the technical execution.

MITRE ATT&CK coverage: T1190 (Exploit Public-Facing Application), T1552 (Unsecured Credentials), T1078 (Valid Accounts), T1486 (Data Encrypted for Impact), and T1485 (Data Destruction).

The Authority Path That Failed

The identity that carried execution authority at the moment of failure was the Langflow server process, invoking exec() on caller-submitted Python inside /api/v1/validate/code — a code-execution endpoint the framework deliberately shipped, and before version 1.3.0 shipped without authentication. The scope that endpoint held was full arbitrary Python execution as the OS user owning the Langflow process. The scope it exercised, in this incident, was identical: it did exactly what it was engineered to do, for a caller that no human ever authorized. The trust anchor that failed first is the deployment decision — encoded in framework defaults, not in any customer configuration — to ship an anonymous internet-facing code-exec surface as the shape of a code-validation feature. Langflow customers were already running unauthenticated exec() before JADEPUFFER dialed the number; the agent’s contribution was to pick up the phone.

The second authority path is the machine-identity blast radius the Langflow host had accumulated. The process’s ambient environment held API keys for four LLM providers, cloud credentials for three continents, a MinIO store, its own PostgreSQL, and — the pivot enabling the ransomware phase — MySQL root credentials with reach into a production Nacos deployment. No boundary separated “credentials this application legitimately needs to serve traffic” from “credentials this host happened to have.” Every one of those keys was a non-human identity whose held scope had never been reconciled against the workload’s actual needs. Once the agent had a shell, harvesting them was a single parallel sweep; the specialty of the attack was that an LLM did the sweeping at machine speed, not that the credentials were reachable at all.

SecurityV0 Perspective

An organization running SecurityV0 would see unproven_execution surface for any Langflow deployment carrying an unauthenticated /api/v1/validate/code endpoint — the resolved framework route, the exec() call site, the absence of an operator-authored authorization record justifying anonymous callers, and the CVE-2025-3248 fix-version delta together satisfy the finding definition. The same organization would see nhi_compromise findings for each machine identity reachable from the Langflow process whose scope exceeds the application’s justified need — the four LLM-provider keys, the seven cloud-provider tokens, and (most consequentially) the MySQL root credential with production reach.

The evidence pack for the unproven_execution finding shows: the Langflow version string, the resolved route table for /api/v1/validate/code, the presence or absence of the 1.3.0 authentication guard, the network exposure of the endpoint, and the CISA KEV listing for CVE-2025-3248. The evidence pack for the nhi_compromise findings enumerates each credential reachable from the Langflow process, its issuer and rotation cadence, the scope it grants, and — critically — a scope-vs-need delta a security team can act on before an agent turns the delta into 1,342 encrypted configuration items. Pre-exfiltration: which of my Langflow deployments are internet-facing on an unpatched build? Post-exfiltration: which downstream identities did the Langflow process have reach to at the moment of compromise, and what did each of them touch?

What To Do

  • Patch Langflow to 1.3.0 or later, and confirm /api/v1/validate/code requires authentication. CVE-2025-3248 has been on CISA’s Known Exploited Vulnerabilities list since 2025-05-05 with a federal remediation deadline of 2025-05-26. If a Langflow host is internet-reachable on an older build, assume the endpoint has already been dialed. Post-patch, run a live probe against the endpoint from an unauthenticated client and verify a 401 or 403 response.
  • Bound the Langflow process’s credential footprint to what the workload actually needs. The JADEPUFFER host held keys for four LLM providers, seven cloud accounts, MinIO, its own database, and a MySQL root with production reach. Move every credential the workflow does not use out of the process environment. Use a per-workflow service account rather than the host’s default identity, and prefer short-lived cloud OIDC tokens over long-lived API keys.
  • Deny outbound cross-tenant reach from LLM application hosts by default. The Nacos pivot in this incident depended on a Langflow host having network reach to a production configuration service and MySQL root credentials that worked when it got there. Neither is a shape a mesh policy should permit implicitly. Egress-filter LLM application hosts to the destinations they are declared to need, and treat cross-tenant lateral reach as a policy exception, not a default.
  • Inventory internal Nacos deployments and patch CVE-2021-29441. The Nacos auth bypass the agent used to mint a rogue administrator is a five-year-old flaw with public exploits. Any Nacos instance behind a “trusted network” boundary is a candidate blast radius for the next agent that clears a perimeter. Enforce authentication on the Nacos AuthFilter, restrict access to a management VLAN, and monitor for administrator creations that do not correspond to a change ticket.
  • Log LLM-side activity from your own applications as an attribution surface. Sysdig’s confidence that this operation was LLM-driven rested on evidence in the payload stream — plain-language reasoning comments, a 31-second cause-and-fix cycle across a login failure. If your infrastructure hosts LLM applications, the same signals cut both ways: retaining structured logs of LLM calls, tool invocations, and their reasoning traces (redacted for secrets) is what lets you distinguish an agent-driven anomaly from a scripted one when you find the aftermath.

Sources

All posts