CVE-2026-104335: Langflow OSS: improper access control enables RCE

HIGH

Published October 6, 2026

CISO Take

Langflow OSS 1.0.0 through 1.12.2 contains an improper access control flaw (CWE-284) that lets any authenticated low-privilege user execute arbitrary code on the server, with a CVSS of 8.8 and no user interaction required. Near-term exploitation likelihood looks modest: EPSS is 0.00565 (top 55%), it is not in CISA KEV, and no public exploit or Nuclei template exists. Even so, Langflow has 183 other CVEs and a package risk score of 77/100, and past Langflow RCE bugs have been weaponized quickly, so treat this as a priority for any multi-user or internet-exposed deployment. Apply the fix described in the IBM advisory (ibm.com/support/pages/node/7290694), restrict Langflow to trusted networks, and review which accounts hold credentials on each instance.

Sources:NVDEPSSibm.comATLAS

What is the risk?

High. The attack is network-based, low complexity, needs only low privileges and no user interaction, and gives full confidentiality, integrity and availability impact. Current exploitation signals are low (EPSS 0.00565, not in KEV, no public PoC or scanner template), so the near-term probability is moderate. Risk rises sharply for shared instances where many users hold accounts, for self-registration or weak credential hygiene, and for instances holding LLM API keys and data connectors. The affected-version range is wide (1.0.0 to 1.12.2), and the patched version is not stated in the structured data and needs to be confirmed in the vendor advisory.

How does the attack unfold?

Initial Access

Attacker obtains valid low-privilege credentials for a network-reachable Langflow instance.

AML.T0012

Exploitation

Attacker abuses the missing access control to reach functionality that executes arbitrary code on the server.

AML.T0049

Credential Access

Attacker harvests LLM API keys, vector database credentials and connector secrets from the host and flow store.

AML.T0055

Impact

Attacker tampers with flows, steals data and pivots into cloud or internal systems with full host control.

AML.T0050

Initial Access

Attacker obtains valid low-privilege credentials for a network-reachable Langflow instance.

AML.T0012

Exploitation

Attacker abuses the missing access control to reach functionality that executes arbitrary code on the server.

AML.T0049

Credential Access

Attacker harvests LLM API keys, vector database credentials and connector secrets from the host and flow store.

AML.T0055

Impact

Attacker tampers with flows, steals data and pivots into cloud or internal systems with full host control.

AML.T0050

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
156.0KPushed 6d ago18% patched~66d to patchFull package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.9%

chance of exploitation in 30 days

Higher than 59% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Check the IBM advisory (https://www.ibm.com/support/pages/node/7290694) for the fixed release and upgrade every instance running 1.0.0 to 1.12.2, including containers and notebooks (pip show langflow). 2) Until patched, restrict network access to Langflow (VPN, allowlist, reverse proxy with SSO), disable open self-registration, and remove unnecessary or shared accounts. 3) Run Langflow as an unprivileged user in a hardened container with egress filtering and no host mounts. 4) Rotate LLM API keys, database credentials and tokens stored in Langflow if compromise is suspected. 5) Detection: monitor for creation or modification of flows and custom components by low-privilege users, unexpected child processes from the Langflow process, and unusual outbound connections.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code ExecutionAuth BypassFrameworkAgentAML.T0012- Valid Accounts AML.T0049- Exploit Public-Facing Application AML.T0050- Command and Scripting Interpreter AML.T0055- Unsecured Credentials

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Response to previously unknown risks and vulnerabilities

OWASP LLM Top 10

LLM03-Supply ChainLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-104335?

Is CVE-2026-104335 actively exploited?

No confirmed active exploitation of CVE-2026-104335 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-104335?

1) Check the IBM advisory (https://www.ibm.com/support/pages/node/7290694) for the fixed release and upgrade every instance running 1.0.0 to 1.12.2, including containers and notebooks (pip show langflow). 2) Until patched, restrict network access to Langflow (VPN, allowlist, reverse proxy with SSO), disable open self-registration, and remove unnecessary or shared accounts. 3) Run Langflow as an unprivileged user in a hardened container with egress filtering and no host mounts. 4) Rotate LLM API keys, database credentials and tokens stored in Langflow if compromise is suspected. 5) Detection: monitor for creation or modification of flows and custom components by low-privilege users, unexpected child processes from the Langflow process, and unusual outbound connections.

What systems are affected by CVE-2026-104335?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines, LLM orchestration platforms, low-code AI workflow builders.

What is the CVSS score for CVE-2026-104335?

CVE-2026-104335 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.87%.

What is the AI security impact?

Affected AI Architectures

agent frameworksRAG pipelinesLLM orchestration platformslow-code AI workflow builders

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0049Exploit Public-Facing Application

AML.T0050Command and Scripting Interpreter

AML.T0055Unsecured Credentials

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03, LLM06

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper access control.

Exploitation Scenario

An attacker obtains low-privilege credentials on a Langflow instance, for example through a leaked account, a self-registration option or credential stuffing. They call an endpoint or feature that lacks proper authorization checks and reach functionality that executes code, such as custom component or code validation handling. This yields a shell as the Langflow service account. They then harvest OpenAI, Anthropic and vector database keys from environment variables and the flow store, and use them for data theft, resource abuse or lateral movement into the cloud environment.

Weaknesses (CWE)

CWE-284Improper Access ControlPrimary CWE-284Improper Access Control

CWE-284 — Improper Access Control: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

[Architecture and Design, Operation] Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
[Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

Source: MITRE CWE corpus.