CVE-2026-104334: Langflow: improper code generation control enables RCE

CRITICALCISA: TRACK*

Published October 7, 2026

CISO Take

Langflow OSS 1.0.0 through 1.12.2 has a code-injection flaw (CWE-94) that lets an unauthenticated remote attacker run arbitrary code on the host, per IBM's advisory. It scores CVSS 9.8 with network access, low complexity and no privileges or user interaction needed. Near-term exploitation pressure looks moderate: EPSS is low (0.617%, around the 52nd percentile), the CVE is not in CISA KEV, and there is no public exploit or Nuclei template yet. Langflow has a poor security track record, though, with 194 other CVEs in the same package and a package risk score of 77/100, and past Langflow RCEs were exploited quickly once details came out. Inventory every Langflow deployment, especially internet-facing ones, and apply the fixed version listed in IBM's advisory (https://www.ibm.com/support/pages/node/7290694). Until patched, restrict network access to the instance and put it behind authentication. The advisory does not give a patched version in our data, so confirm it with IBM before you rely on a specific release number.

Sources:NVDEPSSibm.comATLASOpenSSF

What is the risk?

Severity is critical (CVSS 9.8) because exploitation is remote, needs no authentication or user interaction, and gives full confidentiality, integrity and availability impact. Near-term exploitation likelihood is moderate to low on the data we have: EPSS is 0.00617 (top 52%), the CVE is not in CISA KEV, no public exploit or scanner template exists, and CISA SSVC data is unavailable. Exposure is driven by how many Langflow instances are reachable from the internet or untrusted networks. Langflow's history of code-execution bugs and the package's 194 related CVEs mean attacker interest in it is likely to be high, so EPSS may rise once technical details or a proof of concept appear. Confidence: MEDIUM, because the only source is a brief vendor advisory and NVD description.

How does the attack unfold?

Initial Access

The attacker finds an exposed Langflow instance on a vulnerable version (1.0.0 to 1.12.2) and sends a crafted unauthenticated request.

AML.T0049

Code Execution

The attacker-supplied input reaches the code generation path and runs arbitrary code on the server.

AML.T0050

Credential Access

The attacker reads environment variables and stored configuration to take LLM API keys and data store credentials.

AML.T0055

Impact

The attacker exfiltrates RAG data, tampers with flows, runs up model costs, and uses the host to move laterally.

AML.T0025

Initial Access

The attacker finds an exposed Langflow instance on a vulnerable version (1.0.0 to 1.12.2) and sends a crafted unauthenticated request.

AML.T0049

Code Execution

The attacker-supplied input reaches the code generation path and runs arbitrary code on the server.

AML.T0050

Credential Access

The attacker reads environment variables and stored configuration to take LLM API keys and data store credentials.

AML.T0055

Impact

The attacker exfiltrates RAG data, tampers with flows, runs up model costs, and uses the host to move laterally.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
156.0KPushed 6d ago18% patched~66d to patchFull package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

0.7%

chance of exploitation in 30 days

Higher than 54% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Identify all Langflow deployments (pip package langflow, container images, dev and shared notebooks) and check whether versions fall within 1.0.0 to 1.12.2. 2) Upgrade to the fixed release named in IBM's advisory (https://www.ibm.com/support/pages/node/7290694); our data does not list a patched version, so verify it with IBM. 3) Until patched, remove direct internet exposure, place the instance behind a VPN or an authenticating reverse proxy, and restrict the API and code-validation endpoints. 4) Run Langflow as a non-root user in a container with a read-only filesystem, no host mounts, and egress filtering. 5) Rotate any API keys, database credentials and tokens stored in Langflow if exposure to untrusted networks is suspected. 6) Detection: monitor for unexpected child processes spawned by the Langflow service, outbound connections to unfamiliar hosts, and unusual POST requests to flow-building or code-validation endpoints. Review access logs for unauthenticated requests carrying Python code in the body.

What does CISA's SSVC say?

DecisionTrack*

Exploitationnone

AutomatableYes

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code ExecutionFrameworkAgentAML.T0010.001- AI Software AML.T0049- Exploit Public-Facing Application AML.T0050- Command and Scripting Interpreter

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.10.3-Suppliers

NIST AI RMF

MANAGE 2.3-Response to previously unknown risks and supply chain risks

OWASP LLM Top 10

LLM03-Supply ChainLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-104334?

Is CVE-2026-104334 actively exploited?

No confirmed active exploitation of CVE-2026-104334 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-104334?

1) Identify all Langflow deployments (pip package `langflow`, container images, dev and shared notebooks) and check whether versions fall within 1.0.0 to 1.12.2. 2) Upgrade to the fixed release named in IBM's advisory (https://www.ibm.com/support/pages/node/7290694); our data does not list a patched version, so verify it with IBM. 3) Until patched, remove direct internet exposure, place the instance behind a VPN or an authenticating reverse proxy, and restrict the API and code-validation endpoints. 4) Run Langflow as a non-root user in a container with a read-only filesystem, no host mounts, and egress filtering. 5) Rotate any API keys, database credentials and tokens stored in Langflow if exposure to untrusted networks is suspected. 6) Detection: monitor for unexpected child processes spawned by the Langflow service, outbound connections to unfamiliar hosts, and unusual POST requests to flow-building or code-validation endpoints. Review access logs for unauthenticated requests carrying Python code in the body.

What systems are affected by CVE-2026-104334?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, LLM orchestration platforms, RAG pipelines, low-code AI workflow builders, vector databases.

What is the CVSS score for CVE-2026-104334?

CVE-2026-104334 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 0.71%.

What is the AI security impact?

Affected AI Architectures

agent frameworksLLM orchestration platformsRAG pipelineslow-code AI workflow buildersvector databases

MITRE ATLAS Techniques

AML.T0010.001AI Software

AML.T0049Exploit Public-Facing Application

AML.T0050Command and Scripting Interpreter

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.10.3

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03, LLM06

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper control of code generation.

Exploitation Scenario

An attacker scans for exposed Langflow instances on the internet and finds a vulnerable version between 1.0.0 and 1.12.2. They send a crafted unauthenticated request containing attacker-controlled code to the endpoint that processes custom component or code input, and the server runs it. The payload opens a reverse shell and dumps environment variables, which reveal LLM provider keys and vector database credentials. The attacker then uses those credentials to read proprietary documents from the RAG store, runs up costs on the victim's model accounts, and modifies existing flows to leak user prompts or to keep access to the instance.

Weaknesses (CWE)

CWE-94Improper Control of Generation of Code ('Code Injection')Primary CWE-94Improper Control of Generation of Code ('Code Injection')

CWE-94 — Improper Control of Generation of Code ('Code Injection'): The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

[Architecture and Design] Refactor your program so that you do not have to dynamically generate code.
[Architecture and Design] Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.