CVE-2026-104324: Langflow: unsafe deserialization allows authenticated RCE

HIGH

Published October 29, 2026

CISO Take

IBM Langflow OSS versions 1.0.0 through 1.12.3 contain a deserialization-of-untrusted-data flaw (CWE-502) that lets any authenticated user execute arbitrary code on the server. The CVSS score is 8.8 (high) with low attack complexity and no user interaction, so any valid account, including a self-registered, shared or stolen one, is enough to take over the host. There is currently no EPSS score, no CISA KEV listing, no public exploit and no Nuclei template, so there is no evidence of active exploitation yet. Langflow has been a frequent target of attackers in the past, and a Langflow server typically holds LLM API keys, database credentials and connector secrets, so exploitation would expose far more than the host itself. Check the IBM advisory (ibm.com/support/pages/node/7293015), upgrade past 1.12.3 to the fixed release, and until then restrict Langflow to trusted networks and minimize who holds accounts.

Sources:NVDibm.comATLAS

What is the risk?

Risk is HIGH. Exploitation is network-reachable, needs only low privileges and no user interaction, and gives full confidentiality, integrity and availability impact. The authentication requirement lowers exposure on properly isolated instances, but it offers little protection where Langflow is internet-facing, has open registration or auto-login enabled, or shares accounts among many users. No EPSS, KEV or public exploit data exists at publication, so exploitation likelihood is unknown. Deserialization bugs are well understood and often become weaponized quickly once patch diffs are available, so the risk is likely to rise.

How does the attack unfold?

Initial Access

Attacker obtains a valid low-privilege Langflow account via stolen credentials or open registration.

AML.T0012

Exploitation

Attacker submits a crafted serialized object that Langflow deserializes without validation, triggering code execution.

AML.T0049

Credential Access

Attacker reads LLM API keys, database credentials and secrets stored in the Langflow environment.

AML.T0055

Impact

Attacker takes over the host, tampers with flows and pivots into connected AI and data systems.

AML.T0050

Initial Access

Attacker obtains a valid low-privilege Langflow account via stolen credentials or open registration.

AML.T0012

Exploitation

Attacker submits a crafted serialized object that Langflow deserializes without validation, triggering code execution.

AML.T0049

Credential Access

Attacker reads LLM API keys, database credentials and secrets stored in the Langflow environment.

AML.T0055

Impact

Attacker takes over the host, tampers with flows and pivots into connected AI and data systems.

AML.T0050

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
156.0KPushed 6d ago18% patched~66d to patchFull package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.7%

chance of exploitation in 30 days

Higher than 52% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade IBM Langflow OSS to the fixed version listed in the IBM advisory (newer than 1.12.3). 2) Inventory all Langflow instances, including dev, notebook and containerized deployments, and confirm their versions. 3) Until patched, do not expose Langflow to the internet; place it behind a VPN or an authenticating reverse proxy, disable open self-registration and remove unused or shared accounts. 4) Rotate LLM API keys, database credentials and other secrets stored in Langflow if compromise is suspected. 5) Run Langflow as a non-root user in a hardened container with minimal egress and least-privilege cloud roles. 6) Detection: monitor for unexpected child processes spawned by the Langflow process, outbound connections to unfamiliar hosts, new or modified flows/components, and anomalous authenticated API calls that upload or load serialized objects.

How is it classified?

Code ExecutionSupply ChainFrameworkAgentAML.T0012- Valid Accounts AML.T0049- Exploit Public-Facing Application AML.T0050- Command and Scripting Interpreter AML.T0055- Unsecured Credentials

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Procedures to respond to and recover from previously unknown risks

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-104324?

Is CVE-2026-104324 actively exploited?

No confirmed active exploitation of CVE-2026-104324 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-104324?

1) Upgrade IBM Langflow OSS to the fixed version listed in the IBM advisory (newer than 1.12.3). 2) Inventory all Langflow instances, including dev, notebook and containerized deployments, and confirm their versions. 3) Until patched, do not expose Langflow to the internet; place it behind a VPN or an authenticating reverse proxy, disable open self-registration and remove unused or shared accounts. 4) Rotate LLM API keys, database credentials and other secrets stored in Langflow if compromise is suspected. 5) Run Langflow as a non-root user in a hardened container with minimal egress and least-privilege cloud roles. 6) Detection: monitor for unexpected child processes spawned by the Langflow process, outbound connections to unfamiliar hosts, new or modified flows/components, and anomalous authenticated API calls that upload or load serialized objects.

What systems are affected by CVE-2026-104324?

This vulnerability affects the following AI/ML architecture patterns: Agent frameworks, RAG pipelines, LLM orchestration platforms, Low-code AI workflow builders.

What is the CVSS score for CVE-2026-104324?

CVE-2026-104324 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.66%.

What is the AI security impact?

Affected AI Architectures

Agent frameworksRAG pipelinesLLM orchestration platformsLow-code AI workflow builders

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0049Exploit Public-Facing Application

AML.T0050Command and Scripting Interpreter

AML.T0055Unsecured Credentials

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to deserialization of untrusted data.

Exploitation Scenario

An attacker obtains a low-privilege Langflow account through a leaked credential, a permissive sign-up configuration or a compromised employee login. They send a crafted serialized payload to a Langflow endpoint or flow component that deserializes untrusted data, causing arbitrary code to run in the server process. From there they read environment variables and stored credentials for LLM providers and vector databases, drop a reverse shell, and pivot into internal data stores. They can also modify existing flows to silently exfiltrate prompts and user data passing through the AI application.

Weaknesses (CWE)

CWE-502Deserialization of Untrusted DataPrimary CWE-502Deserialization of Untrusted Data

CWE-502 — Deserialization of Untrusted Data: The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

[Architecture and Design, Implementation] If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
[Implementation] When deserializing data, populate a new object rather than just deserializing. The result is that the data flows through safe input validation and that the functions are safe.

Source: MITRE CWE corpus.