AI Orchestration Platforms Found Vulnerable to Remote Code Execution by Design

The author audited seven AI orchestration platforms (NocoBase, Flowise, Langflow, Dify, Activepieces, Kestra, and Airflow) and disclosed 14 security findings. All platforms assumed that any user with workflow access was trusted to execute code on the host, which enabled remote code execution (RCE) via unauthenticated webhooks. A specific attack chain in Flowise demonstrated how an unauthenticated request could lead to prompt injection, Python code execution, and RCE due to insufficient regex filtering. Two vendors dismissed the reports as 'working-as-intended.'