Machine Synopsis

`Fireflow` is a medium difficulty Linux machine that starts off with a leaked Langflow `flow_id`. With this, an attacker is able to exploit the unauthenticated CVE-2026-33017 and get a shell as `www-data` on the remote machine. There, he will find that a password in Langflow's `.env` file is reused by the user `nightfall`, who is able to SSH into the machine. In the home directory of `nightfall`, a configuration file leaks sensitive information on how to connect to a custom MCP server. From there, it is discovered that an attacker can craft a malicious JWT token and impersonate an administrative user since the signing algorithms on the token also have the option `None`. Then, they are able to register a custom malicious tool and get a shell on the MCP pod. Enumerating the Kubernetes environment reveals that the `nodes/proxy` permission is set. This allows the attacker to execute arbitrary commands on privileged pods and eventually gain root on the host file system.