CVE-2026-82278

Bisheng, an open-source LLM workflow platform, is vulnerable to remote code execution (CWE-94) in its workflow run_once endpoint in versions before 2.6.0. An authenticated attacker sends a crafted Code node definition to the POST /api/v1/workflow/run_once endpoint, and the server executes the submitted Python code with exec() without any sandboxing. Successful exploitation yields arbitrary code execution on the host, giving the attacker access to the filesystem, stored credentials, and internal network resources reachable from the deployment. Any organization running an affected Bisheng version is exposed, though the flaw requires valid authentication, so only accounts permitted to invoke workflow runs can be abused. No public proof-of-concept, KEV listing, or confirmed in-the-wild exploitation is known; EPSS currently estimates a 0.6% chance of exploitation within 30 days.

What to do: Upgrade Bisheng to version 2.6.0 or later, which resolves the flaw. Until then, restrict access to POST /api/v1/workflow/run_once to trusted, authenticated users, review Code node definitions for untrusted or overly permissive Python code, and avoid exposing Bisheng instances directly to the internet; monitor instances for unexpected process or network activity from workflow executions.