CVE-2026-10134: Langflow unauthenticated RCE

CISO Take

This is a maximum-severity code injection flaw (CWE-94) in IBM Langflow, the open-source low-code builder for LLM/agent workflows, that lets any unauthenticated network attacker execute arbitrary code in the Langflow process — zero credentials, zero user interaction, low attack complexity. The blast radius is total: an attacker can read every secret the process can see (API keys, DB creds, cloud tokens), read and rewrite every flow, conversation, message, upload, and saved component, pivot into internal services and cloud metadata endpoints, and hop laterally to other tenants sharing the same instance — a direct hit on any multi-tenant Langflow deployment. Worse, the attacker gets durable persistence for free by rewriting a public flow's `tool_code`, so every legitimate `/api/v1/build/...` call from any subsequent user silently re-executes the attacker's payload, effectively backdooring the platform for everyone who uses it. There's no public PoC, no Nuclei template, and it isn't yet in CISA KEV, and EPSS sits at a modest 0.00314 in absolute terms (still top 77th percentile of all scored CVEs) — but a CVSS 10.0, zero prerequisites, and a self-reinfecting persistence mechanism make this a prime target the moment exploit details circulate. Patch to the fixed Langflow release immediately, rotate every secret the process could have touched, and audit all stored flows for unauthorized `tool_code` tampering before assuming you're clean.

Sources: NVD EPSS ATLAS ibm.com

What is the risk?

Maximum risk on every axis CVSS measures: network-exploitable, low complexity, no privileges or user interaction required, scope-changed with full confidentiality/integrity/availability impact (CVSS 10.0). The absence of a public exploit, Nuclei template, or CISA KEV listing lowers near-term mass-exploitation likelihood, and EPSS's absolute score (0.00314) is low — but that reflects general internet-wide scanning patterns, not the ease of exploiting this specific, well-documented, unauthenticated code-injection path once weaponized. Any internet-facing or multi-tenant Langflow instance running 1.0.0–1.9.3 should be treated as already compromised until patched and audited, given the trivial prerequisites and catastrophic blast radius (full secret disclosure, cross-tenant pivoting, persistent backdoor).

How does the attack unfold?

Initial Access

Attacker sends a crafted, unauthenticated request to a public-facing Langflow instance, triggering the CWE-94 code injection flaw.

AML.T0049

Execution & Discovery

Arbitrary code executes in the Langflow process, giving the attacker access to every secret, flow, and database record the process can reach.

AML.T0055

Persistence

Attacker modifies a public flow's tool_code so any future /api/v1/build/... call by any user re-executes the malicious payload, backdooring the platform.

AML.T0110

Impact & Lateral Movement

Attacker abuses cloud metadata endpoints for cloud credentials and pivots laterally to other tenants' data on the same shared Langflow instance.

AML.T0075

Initial Access

Attacker sends a crafted, unauthenticated request to a public-facing Langflow instance, triggering the CWE-94 code injection flaw.

AML.T0049

Execution & Discovery

Arbitrary code executes in the Langflow process, giving the attacker access to every secret, flow, and database record the process can reach.

AML.T0055

Persistence

Attacker modifies a public flow's tool_code so any future /api/v1/build/... call by any user re-executes the malicious payload, backdooring the platform.

AML.T0110

Impact & Lateral Movement

Attacker abuses cloud metadata endpoints for cloud credentials and pivots laterally to other tenants' data on the same shared Langflow instance.

AML.T0075

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
153.0K Pushed 6d ago 26% patched ~70d to patch Full package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

10.0 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 29% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Changed

C High

I High

A High

What should I do?

1 step

1) Upgrade Langflow to the patched release beyond 1.9.3 immediately — do not wait for a scheduled maintenance window given the CVSS 10.0 score. 2) Rotate every secret, API key, and credential accessible to the Langflow process, since the flaw allows reading all process-visible secrets. 3) Audit the flows database for unauthorized modifications to tool_code fields, particularly on public/shared flows, to detect the described persistence mechanism. 4) Restrict network exposure of the Langflow API (VPN/allowlist/reverse-proxy auth) until patched, and disable public flow sharing where not strictly required. 5) Block or restrict outbound access to cloud metadata endpoints (e.g., 169.254.169.254) from the Langflow host/container via egress filtering or IMDSv2 enforcement. 6) In multi-tenant deployments, review tenant isolation controls and treat any exposed instance as a potential cross-tenant compromise vector until confirmed patched and audited.

What does CISA's SSVC say?

Decision Track*

Exploitation none

Automatable Yes

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Data Leakage Auth Bypass Framework Agent Plugin AML.T0049 - Exploit Public-Facing Application AML.T0055 - Unsecured Credentials AML.T0075 - Cloud Service Discovery AML.T0091.000 - Application Access Token AML.T0110 - AI Agent Tool Poisoning

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6 - Third party and customer relationships / AI system security

NIST AI RMF

MEASURE-2.7 - AI system security and resilience is evaluated and documented

OWASP LLM Top 10

LLM07 - Insecure Plugin Design

Frequently Asked Questions

What is CVE-2026-10134?

This is a maximum-severity code injection flaw (CWE-94) in IBM Langflow, the open-source low-code builder for LLM/agent workflows, that lets any unauthenticated network attacker execute arbitrary code in the Langflow process — zero credentials, zero user interaction, low attack complexity. The blast radius is total: an attacker can read every secret the process can see (API keys, DB creds, cloud tokens), read and rewrite every flow, conversation, message, upload, and saved component, pivot into internal services and cloud metadata endpoints, and hop laterally to other tenants sharing the same instance — a direct hit on any multi-tenant Langflow deployment. Worse, the attacker gets durable persistence for free by rewriting a public flow's `tool_code`, so every legitimate `/api/v1/build/...` call from any subsequent user silently re-executes the attacker's payload, effectively backdooring the platform for everyone who uses it. There's no public PoC, no Nuclei template, and it isn't yet in CISA KEV, and EPSS sits at a modest 0.00314 in absolute terms (still top 77th percentile of all scored CVEs) — but a CVSS 10.0, zero prerequisites, and a self-reinfecting persistence mechanism make this a prime target the moment exploit details circulate. Patch to the fixed Langflow release immediately, rotate every secret the process could have touched, and audit all stored flows for unauthorized `tool_code` tampering before assuming you're clean.

Is CVE-2026-10134 actively exploited?

No confirmed active exploitation of CVE-2026-10134 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-10134?

1) Upgrade Langflow to the patched release beyond 1.9.3 immediately — do not wait for a scheduled maintenance window given the CVSS 10.0 score. 2) Rotate every secret, API key, and credential accessible to the Langflow process, since the flaw allows reading all process-visible secrets. 3) Audit the flows database for unauthorized modifications to `tool_code` fields, particularly on public/shared flows, to detect the described persistence mechanism. 4) Restrict network exposure of the Langflow API (VPN/allowlist/reverse-proxy auth) until patched, and disable public flow sharing where not strictly required. 5) Block or restrict outbound access to cloud metadata endpoints (e.g., 169.254.169.254) from the Langflow host/container via egress filtering or IMDSv2 enforcement. 6) In multi-tenant deployments, review tenant isolation controls and treat any exposed instance as a potential cross-tenant compromise vector until confirmed patched and audited.

What systems are affected by CVE-2026-10134?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, LLM workflow orchestration, multi-tenant SaaS platforms, RAG pipelines.

What is the CVSS score for CVE-2026-10134?

CVE-2026-10134 has a CVSS v3.1 base score of 10.0 (CRITICAL). The EPSS exploitation probability is 0.36%.

What is the AI security impact?

Affected AI Architectures

agent frameworksLLM workflow orchestrationmulti-tenant SaaS platformsRAG pipelines

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0055 Unsecured Credentials

AML.T0075 Cloud Service Discovery

AML.T0091.000 Application Access Token

AML.T0110 AI Agent Tool Poisoning

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MEASURE-2.7

OWASP LLM Top 10: LLM07

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.9.3 allows an attacker to read every secret available to the Langflow process, read and modify every flow, conversation, message, file upload, and saved component in the Langflow database, can connect to internal services, abuse cloud metadata endpoints, laterally move to other tenants on the same Langflow instance, and Establish persistence by modifying the public flow's `tool_code` so normal `/api/v1/build/...` calls by any user re-execute attacker code at each build.

Exploitation Scenario

An attacker scans the internet for exposed Langflow instances and sends a crafted request that triggers the CWE-94 code injection flaw, achieving arbitrary code execution inside the Langflow process without any credentials. From there, they harvest every secret and credential the process can reach — database passwords, third-party API keys, cloud tokens — and query the instance's cloud metadata endpoint to obtain cloud IAM credentials for further lateral movement. Using that access, the attacker enumerates and reads other tenants' flows, conversations, and file uploads on the same shared instance. To guarantee they keep access even after the initial entry point is noticed or patched, the attacker modifies the `tool_code` of a public flow so that every future `/api/v1/build/...` call — issued by any legitimate user of the platform — silently re-executes their payload, turning a one-time injection into a standing backdoor across the entire user base.

Weaknesses (CWE)

CWE-94 Improper Control of Generation of Code ('Code Injection') Primary CWE-94 Improper Control of Generation of Code ('Code Injection')

CWE-94 — Improper Control of Generation of Code ('Code Injection'): The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

[Architecture and Design] Refactor your program so that you do not have to dynamically generate code.
[Architecture and Design] Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.