CVE-2026-103092: Langflow: SQL injection via broken access control

HIGH

Published October 29, 2026

CISO Take

IBM Langflow OSS versions 1.0.0 through 1.12.3 have an access control flaw (CWE-284) that lets any low-privileged authenticated user run arbitrary SQL commands against the backend database. The CVSS score is 8.5 (High) with a changed scope, meaning the impact can reach beyond the Langflow application into the underlying database, which typically holds flows, user accounts, API keys and stored LLM provider credentials. There is currently no public exploit, no Nuclei template, no CISA KEV listing and no EPSS score, so exploitation is not yet observed. However, the attack is low complexity over the network and Langflow has a history of being targeted, so treat it as a priority patch. Apply the fixed release listed in the IBM advisory (node 7293015), restrict Langflow to trusted networks, and review database logs for unexpected queries issued by application accounts.

Sources:NVDibm.comATLAS

What is the risk?

High. The attack is network-reachable, low complexity, needs only low privileges and no user interaction, and the scope is changed, so impact extends to the backing database. Integrity impact is high and availability impact is low, with no confidentiality impact in the CVSS vector, though arbitrary SQL could still expose data in practice. Exploitation is not yet observed: there is no KEV listing, public exploit or scanner template, and EPSS is unavailable. Exposure depends on whether Langflow is internet-facing and how many users hold accounts. Multi-tenant or shared instances carry the most risk. Details are limited to the NVD description and the IBM advisory, so confidence in the technical specifics is medium.

How does the attack unfold?

Initial Access

Attacker logs in with a low-privilege Langflow account obtained through registration or stolen credentials.

AML.T0012

Exploitation

Attacker sends crafted requests that bypass access control and inject arbitrary SQL into the backend database.

AML.T0049

Credential Access

Attacker reads stored API keys and provider credentials from the database.

AML.T0083

Impact

Attacker modifies or deletes flows and records, disrupting AI workflows and pivoting to connected services.

Initial Access

Attacker logs in with a low-privilege Langflow account obtained through registration or stolen credentials.

AML.T0012

Exploitation

Attacker sends crafted requests that bypass access control and inject arbitrary SQL into the backend database.

AML.T0049

Credential Access

Attacker reads stored API keys and provider credentials from the database.

AML.T0083

Impact

Attacker modifies or deletes flows and records, disrupting AI workflows and pivoting to connected services.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
156.0KPushed 6d ago18% patched~66d to patchFull package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 35% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade IBM Langflow OSS to the fixed version named in IBM advisory node 7293015 (anything later than 1.12.3 once confirmed). 2) Until patched, limit access to Langflow to trusted networks or VPN and disable open self-registration. 3) Audit existing accounts and remove unneeded or low-trust users. 4) Run the Langflow database account with least privilege, with no access to other schemas and no administrative rights. 5) Enable database query logging and alert on unusual statements, schema changes or bulk reads and writes. 6) Rotate API keys and provider credentials stored in Langflow if you suspect abuse. 7) Back up the database and test restoration.

How is it classified?

Auth BypassData ExtractionFrameworkAgentAML.T0012- Valid Accounts AML.T0049- Exploit Public-Facing Application AML.T0083- Credentials from AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responses to previously unknown risks and vulnerabilities

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-103092?

Is CVE-2026-103092 actively exploited?

No confirmed active exploitation of CVE-2026-103092 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-103092?

1) Upgrade IBM Langflow OSS to the fixed version named in IBM advisory node 7293015 (anything later than 1.12.3 once confirmed). 2) Until patched, limit access to Langflow to trusted networks or VPN and disable open self-registration. 3) Audit existing accounts and remove unneeded or low-trust users. 4) Run the Langflow database account with least privilege, with no access to other schemas and no administrative rights. 5) Enable database query logging and alert on unusual statements, schema changes or bulk reads and writes. 6) Rotate API keys and provider credentials stored in Langflow if you suspect abuse. 7) Back up the database and test restoration.

What systems are affected by CVE-2026-103092?

This vulnerability affects the following AI/ML architecture patterns: LLM workflow orchestration, Agent frameworks, RAG pipelines, Low-code AI application builders.

What is the CVSS score for CVE-2026-103092?

CVE-2026-103092 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.41%.

What is the AI security impact?

Affected AI Architectures

LLM workflow orchestrationAgent frameworksRAG pipelinesLow-code AI application builders

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0049Exploit Public-Facing Application

AML.T0083Credentials from AI Agent Configuration

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper access control.

Exploitation Scenario

An attacker obtains a low-privilege Langflow account, for example through open registration, a phished user or reused credentials. They send crafted requests to an endpoint with a missing access control check and inject SQL. They read stored API keys and provider credentials, modify flow definitions to change agent behavior or insert malicious components, and alter or delete records to disrupt AI workflows. The stolen credentials can then give access to LLM providers, vector databases and connected data sources.

Weaknesses (CWE)

CWE-284Improper Access ControlPrimary CWE-284Improper Access Control

CWE-284 — Improper Access Control: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

[Architecture and Design, Operation] Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
[Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

Source: MITRE CWE corpus.