CVE-2026-104328: Langflow OSS: OS command injection allows authenticated RCE

HIGH

Published October 29, 2026

CISO Take

IBM Langflow OSS 1.0.0 through 1.12.3 contains an OS command injection flaw (CWE-94) that lets any authenticated user execute arbitrary code on the server, rated CVSS 8.8 with a network-reachable, low-complexity attack path and no user interaction. It is not in CISA KEV, no public exploit or Nuclei template is known, and EPSS and SSVC data are not yet available, so current exploitation likelihood is unproven. However, Langflow has historically been a high-value target, and a low-privilege account is enough to reach the host, where LLM API keys, vector database credentials and connected data sources are typically stored. Upgrade to the fixed version listed in the IBM advisory (https://www.ibm.com/support/pages/node/7293015) as soon as possible, and until then restrict Langflow to trusted networks and review who holds accounts.

Sources:NVDATLASibm.com

What is the risk?

High. The attack is network-based, low complexity, needs only low privileges and no user interaction, with full confidentiality, integrity and availability impact (CVSS 8.8). Mitigating factors: authentication is required, there is no known public exploit or scanner template, and the flaw is not in CISA KEV. EPSS and downstream dependent counts are unavailable, so real-world exposure cannot be quantified. Risk rises sharply for internet-exposed instances, multi-user deployments, or instances with open self-registration, where the authentication barrier is effectively removed.

How does the attack unfold?

Initial Access

Attacker authenticates to a reachable Langflow instance with a low-privilege account.

AML.T0049

Execution

A crafted request injects special elements that are executed as OS commands or code on the server.

AML.T0050

Credential Access

The attacker reads environment variables and config files holding LLM API keys and database credentials.

Impact

Full host compromise enables data theft, flow tampering and lateral movement into connected AI and data infrastructure.

Initial Access

Attacker authenticates to a reachable Langflow instance with a low-privilege account.

AML.T0049

Execution

A crafted request injects special elements that are executed as OS commands or code on the server.

AML.T0050

Credential Access

The attacker reads environment variables and config files holding LLM API keys and database credentials.

Impact

Full host compromise enables data theft, flow tampering and lateral movement into connected AI and data infrastructure.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
156.0KPushed 6d ago18% patched~66d to patchFull package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.7%

chance of exploitation in 30 days

Higher than 53% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade IBM Langflow OSS to the fixed release named in the IBM advisory (https://www.ibm.com/support/pages/node/7293015); versions 1.0.0 through 1.12.3 are affected. 2) Do not expose Langflow directly to the internet; place it behind a VPN or an authenticating reverse proxy and disable open self-registration. 3) Audit existing accounts and remove unneeded or shared ones. 4) Run Langflow as a non-root user in a container with minimal privileges, restricted egress and no host mounts. 5) Rotate LLM API keys, database credentials and other secrets stored on affected instances if compromise is suspected. 6) Detection: monitor for unexpected child processes spawned by the Langflow process, unusual outbound connections, and anomalous API calls to flow or component endpoints from low-privilege accounts.

How is it classified?

Code ExecutionFrameworkAgentAML.T0012- Valid Accounts AML.T0049- Exploit Public-Facing Application AML.T0050- Command and Scripting Interpreter

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Response to previously unknown risks

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-104328?

Is CVE-2026-104328 actively exploited?

No confirmed active exploitation of CVE-2026-104328 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-104328?

1) Upgrade IBM Langflow OSS to the fixed release named in the IBM advisory (https://www.ibm.com/support/pages/node/7293015); versions 1.0.0 through 1.12.3 are affected. 2) Do not expose Langflow directly to the internet; place it behind a VPN or an authenticating reverse proxy and disable open self-registration. 3) Audit existing accounts and remove unneeded or shared ones. 4) Run Langflow as a non-root user in a container with minimal privileges, restricted egress and no host mounts. 5) Rotate LLM API keys, database credentials and other secrets stored on affected instances if compromise is suspected. 6) Detection: monitor for unexpected child processes spawned by the Langflow process, unusual outbound connections, and anomalous API calls to flow or component endpoints from low-privilege accounts.

What systems are affected by CVE-2026-104328?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines, LLM workflow orchestration, low-code AI builders.

What is the CVSS score for CVE-2026-104328?

CVE-2026-104328 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.70%.

What is the AI security impact?

Affected AI Architectures

agent frameworksRAG pipelinesLLM workflow orchestrationlow-code AI builders

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0049Exploit Public-Facing Application

AML.T0050Command and Scripting Interpreter

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.

Exploitation Scenario

An attacker obtains a low-privilege Langflow account, through self-registration, a phished user, or reused credentials. They send a crafted request to the vulnerable component or endpoint, embedding shell metacharacters or code that is passed unsanitized to the OS or interpreter. The server runs the payload and the attacker gets a shell, reads environment variables holding OpenAI and vector database keys, dumps stored flows, and then moves laterally into the cloud account or internal data sources the AI workflows connect to.

Weaknesses (CWE)

CWE-94Improper Control of Generation of Code ('Code Injection')Primary CWE-94Improper Control of Generation of Code ('Code Injection')

CWE-94 — Improper Control of Generation of Code ('Code Injection'): The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

[Architecture and Design] Refactor your program so that you do not have to dynamically generate code.
[Architecture and Design] Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.