CVE-2026-104308: Langflow: OS command injection allows authenticated DoS

MEDIUM

Published October 29, 2026

CISO Take

IBM Langflow OSS versions 1.0.0 through 1.12.3 contain an OS command injection flaw (CWE-78) that lets a logged-in user trigger a denial of service. Severity is medium (CVSS 4.3), and the impact is limited to availability, with no confidentiality or integrity impact in the scoring. It is not in CISA KEV, there is no public exploit or Nuclei template, and no EPSS data is available yet, so near-term exploitation likelihood looks low. The practical concern is that command injection weaknesses often hide broader impact than the vendor scoring suggests, and Langflow instances commonly run with access to LLM API keys and data connectors. Review the IBM advisory (support/pages/node/7293015), upgrade beyond 1.12.3 once the fixed release is confirmed, and limit Langflow access to trusted users until then.

Sources:NVDibm.comATLAS

What is the risk?

Medium. The attack is network-reachable with low complexity and needs only a low-privileged account and no user interaction. The scored impact is availability only. Exposure depends on who holds Langflow accounts: multi-tenant or broadly shared instances carry more risk than single-user deployments. There is no known exploitation, no public PoC, and no KEV listing. The CWE-78 root cause means the real impact could exceed the vendor rating, but that is unconfirmed (confidence: MEDIUM).

How does the attack unfold?

Initial Access

Attacker authenticates to Langflow with a low-privileged account.

AML.T0012

Exploitation

Attacker sends input containing shell special characters that are not neutralized before reaching an OS command.

AML.T0050

Impact

The injected command disrupts the Langflow process, causing a denial of service for dependent AI workflows.

AML.T0029

Initial Access

Attacker authenticates to Langflow with a low-privileged account.

AML.T0012

Exploitation

Attacker sends input containing shell special characters that are not neutralized before reaching an OS command.

AML.T0050

Impact

The injected command disrupts the Langflow process, causing a denial of service for dependent AI workflows.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
156.0KPushed 6d ago18% patched~66d to patchFull package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

4.3 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 27% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CNone

INone

ALow

What should I do?

1 step

1) Check the IBM advisory at https://www.ibm.com/support/pages/node/7293015 and upgrade to the fixed release as soon as it is available. 2) Inventory Langflow deployments and identify any running 1.0.0 to 1.12.3. 3) Restrict access to trusted users, enforce strong authentication, and avoid exposing Langflow to the internet. 4) Run Langflow in a container with minimal privileges and a restricted filesystem and network egress. 5) Monitor for unexpected child processes, shell invocations, and service crashes or restarts. 6) Add health checks and auto-restart to limit downtime.

How is it classified?

DoSCode ExecutionFrameworkAgentAML.T0029- Denial of AI Service AML.T0049- Exploit Public-Facing Application AML.T0050- Command and Scripting Interpreter

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Response to previously unknown risks

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-104308?

Is CVE-2026-104308 actively exploited?

No confirmed active exploitation of CVE-2026-104308 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-104308?

1) Check the IBM advisory at https://www.ibm.com/support/pages/node/7293015 and upgrade to the fixed release as soon as it is available. 2) Inventory Langflow deployments and identify any running 1.0.0 to 1.12.3. 3) Restrict access to trusted users, enforce strong authentication, and avoid exposing Langflow to the internet. 4) Run Langflow in a container with minimal privileges and a restricted filesystem and network egress. 5) Monitor for unexpected child processes, shell invocations, and service crashes or restarts. 6) Add health checks and auto-restart to limit downtime.

What systems are affected by CVE-2026-104308?

This vulnerability affects the following AI/ML architecture patterns: Agent frameworks, RAG pipelines, LLM workflow orchestration, Low-code AI builders.

What is the CVSS score for CVE-2026-104308?

CVE-2026-104308 has a CVSS v3.1 base score of 4.3 (MEDIUM). The EPSS exploitation probability is 0.34%.

What is the AI security impact?

Affected AI Architectures

Agent frameworksRAG pipelinesLLM workflow orchestrationLow-code AI builders

MITRE ATLAS Techniques

AML.T0029Denial of AI Service

AML.T0049Exploit Public-Facing Application

AML.T0050Command and Scripting Interpreter

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to cause a denial of service due to improper neutralization of special elements used in an OS command.

Exploitation Scenario

An attacker with a low-privileged Langflow account, such as a contractor or a compromised developer credential, submits crafted input through a component or API parameter that reaches an OS command. The special characters are not neutralized, so the injected command disrupts the service process and causes a denial of service. Dependent AI workflows and agents go offline until the service is restarted.

Weaknesses (CWE)

CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Primary CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-78 — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'): The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

[Architecture and Design] If at all possible, use library calls rather than external processes to recreate the desired functionality.
[Architecture and Design, Operation] Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software. OS-level examples include the Unix chroot jail, AppArmor, and SELinux. In general, managed code may provide some protection. For example, java.io.FilePermission in the Java SecurityManager allows the software to specify restrictions on file operations. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of the application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.