CVE-2026-101288: Langflow: code injection allows authenticated RCE

HIGH

Published October 29, 2026

CISO Take

IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a code injection flaw (CWE-94) that lets any authenticated user execute arbitrary code on the server. Langflow typically holds LLM API keys, vector database credentials and cloud tokens, so one compromised low-privilege account can expose the whole AI stack. There is no public exploit, no Nuclei template and no CISA KEV listing, and EPSS data is not yet available, so there is no sign of active exploitation. Still, the attack is network-reachable, low complexity and needs no user interaction, and Langflow's code-execution flaws have drawn attacker interest before. Upgrade to the fixed release in the IBM advisory (node 7293015), restrict Langflow to trusted networks, and review who holds accounts, including any self-registration.

Sources:NVDATLASibm.com

What is the risk?

High (CVSS 8.8). The attack is network-based, low complexity, needs only low privileges and no user interaction, and has high impact on confidentiality, integrity and availability. Exposure depends on who can authenticate: instances with open signup, shared team accounts or weak credentials are the most at risk. EPSS is unavailable, there is no known public exploit and the CVE is not in CISA KEV, so near-term mass exploitation is less likely than for a pre-auth bug. A wide affected range (1.0.0 to 1.12.3) means most deployments are in scope. Internet-exposed instances and those with a long-lived admin or API user base are highest priority.

How does the attack unfold?

Initial Access

Attacker authenticates to the Langflow instance with low-privilege or self-registered credentials.

AML.T0012

Exploitation

Attacker submits crafted input that the server evaluates as code due to improper neutralization.

AML.T0049

Execution

Injected code runs on the Langflow host with the service's privileges.

AML.T0050

Impact

Attacker steals LLM and data store credentials, tampers with flows and pivots into connected systems.

AML.T0055

Initial Access

Attacker authenticates to the Langflow instance with low-privilege or self-registered credentials.

AML.T0012

Exploitation

Attacker submits crafted input that the server evaluates as code due to improper neutralization.

AML.T0049

Execution

Injected code runs on the Langflow host with the service's privileges.

AML.T0050

Impact

Attacker steals LLM and data store credentials, tampers with flows and pivots into connected systems.

AML.T0055

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
156.0KPushed 6d ago18% patched~66d to patchFull package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.7%

chance of exploitation in 30 days

Higher than 53% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade Langflow OSS to the fixed version listed in the IBM advisory (https://www.ibm.com/support/pages/node/7293015); versions 1.0.0 through 1.12.3 are vulnerable. 2) Until patched, remove public exposure, put Langflow behind a VPN or an authenticating reverse proxy, and disable open registration. 3) Audit and prune user accounts, enforce strong credentials and MFA at the proxy, and rotate API keys and secrets stored in Langflow. 4) Run Langflow in a minimal-privilege container with restricted egress and no broad cloud IAM role. 5) Detect: monitor for unexpected child processes spawned by the Langflow service, unusual outbound connections, and API calls that create or modify components with custom code.

How is it classified?

Code ExecutionFrameworkAgentAML.T0012- Valid Accounts AML.T0049- Exploit Public-Facing Application AML.T0050- Command and Scripting Interpreter

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Response to unknown or newly identified risks

OWASP LLM Top 10

LLM03-Supply ChainLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-101288?

Is CVE-2026-101288 actively exploited?

No confirmed active exploitation of CVE-2026-101288 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-101288?

1) Upgrade Langflow OSS to the fixed version listed in the IBM advisory (https://www.ibm.com/support/pages/node/7293015); versions 1.0.0 through 1.12.3 are vulnerable. 2) Until patched, remove public exposure, put Langflow behind a VPN or an authenticating reverse proxy, and disable open registration. 3) Audit and prune user accounts, enforce strong credentials and MFA at the proxy, and rotate API keys and secrets stored in Langflow. 4) Run Langflow in a minimal-privilege container with restricted egress and no broad cloud IAM role. 5) Detect: monitor for unexpected child processes spawned by the Langflow service, unusual outbound connections, and API calls that create or modify components with custom code.

What systems are affected by CVE-2026-101288?

This vulnerability affects the following AI/ML architecture patterns: Agent frameworks, RAG pipelines, LLM workflow orchestration, Low-code AI app builders.

What is the CVSS score for CVE-2026-101288?

CVE-2026-101288 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.70%.

What is the AI security impact?

Affected AI Architectures

Agent frameworksRAG pipelinesLLM workflow orchestrationLow-code AI app builders

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0049Exploit Public-Facing Application

AML.T0050Command and Scripting Interpreter

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03, LLM06

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in code.

Exploitation Scenario

An attacker obtains low-privilege Langflow credentials through open signup, credential stuffing or a phished employee account. They submit a crafted flow or component whose code field carries attacker-controlled Python that the server evaluates without proper neutralization. The code runs with the Langflow process's privileges and reads environment variables containing OpenAI and vector database keys. The attacker then exfiltrates those secrets, installs a reverse shell for persistence, and moves into the internal network or the cloud account tied to the host.

Weaknesses (CWE)

CWE-94Improper Control of Generation of Code ('Code Injection')Primary CWE-94Improper Control of Generation of Code ('Code Injection')

CWE-94 — Improper Control of Generation of Code ('Code Injection'): The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

[Architecture and Design] Refactor your program so that you do not have to dynamically generate code.
[Architecture and Design] Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.