CVE-2026-82278

Received Received - Intake

Remote Code Execution in BISHENG Workflow Engine

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: VulnCheck

Description

BISHENG before 2.6.0 contains a remote code execution vulnerability in the workflow run_once endpoint that allows authenticated users to execute arbitrary Python code. Attackers can submit crafted Code node definitions to the POST /api/v1/workflow/run_once endpoint, which executes them with exec() without sandboxing, gaining access to filesystem, credentials, and internal network resources.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-28

Generated

2026-08-29

AI Q&A

2026-08-29

EPSS Evaluated

N/A

NVD

CVE-2026-82278

EUVD

EUVD-2026-67809

Affected Vendors & Products

Vendor	Product	Version / Range
bisheng	bisheng	to 2.6.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

CVE-2026-82278 is a remote code execution vulnerability in BISHENG versions before 2.6.0. It affects the workflow run_once endpoint where authenticated users can submit crafted Code node definitions. The application executes these using exec() without sandboxing, allowing arbitrary Python code to run with backend privileges.

Detection Guidance

Check Bisheng versions prior to 2.6.0 for the vulnerable workflow run_once endpoint. Monitor logs for POST requests to /api/v1/workflow/run_once with Code node inputs. Look for exec() calls without sandboxing in workflow.py files.

Impact Analysis

An attacker with valid credentials can execute arbitrary code on the server running BISHENG. This grants access to filesystem, credentials, internal network resources, and potentially full control of the system if BISHENG runs as root. Even guest accounts may exploit this if session tokens are obtainable.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and security. It enables unauthorized access to sensitive data (filesystem, credentials), which could lead to breaches of GDPR (data protection) or HIPAA (health information privacy). Organizations using affected versions must patch immediately to maintain compliance.

Mitigation Strategies

Upgrade Bisheng to version 2.6.0 or later. Restrict access to the /api/v1/workflow/run_once endpoint. Implement strict input validation for Code nodes. Disable guest accounts if possible. Review and revoke exposed credentials.

Hi! I’m here to help you understand CVE-2026-82278. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70