CVE-2026-104339: Langflow: OS command injection allows remote RCE

CRITICAL

Published October 29, 2026

CISO Take

IBM Langflow OSS versions 1.0.0 through 1.12.3 contain an OS command injection flaw (CWE-94) that lets an unauthenticated remote attacker execute arbitrary code, scoring CVSS 9.8 with network access, low complexity, no privileges and no user interaction. It is not yet in CISA KEV, no public exploit or Nuclei template is known, and EPSS and downstream dependent data are unavailable, so exploitation likelihood is unquantified. Even so, Langflow has a history of exploited RCE flaws and typically holds LLM API keys, vector database credentials and connector secrets, so a compromised instance is a gateway to the rest of the AI stack. Check where Langflow is deployed, upgrade past 1.12.3 per the IBM advisory (https://www.ibm.com/support/pages/node/7293015), and take any internet-exposed instance behind authentication or off the internet until it is patched.

Sources:NVDibm.comATLAS

What is the risk?

Critical. The CVSS vector (AV:N/AC:L/PR:N/UI:N) means any attacker who can reach the service can exploit it without credentials or user interaction, with full confidentiality, integrity and availability impact. Confidence is MEDIUM: the data comes from the NVD description and the IBM advisory, with no EPSS score, KEV listing, public exploit or scanner template yet. Exposure depends on whether instances are internet-facing. Langflow's low-code design and common use in prototyping often mean weak network controls, which raises real-world risk. Because the range starts at 1.0.0, essentially every deployed version is affected.

How does the attack unfold?

Initial Access

Attacker finds an exposed Langflow instance and sends a crafted request to the vulnerable endpoint without authentication.

AML.T0049

Execution

Injected special elements are passed to an OS command or code interpreter, yielding arbitrary code execution on the host.

AML.T0050

Credential Access

Attacker harvests LLM API keys, vector database and cloud credentials stored in the Langflow environment.

AML.T0055

Impact

Attacker tampers with flows, exfiltrates processed data and pivots into connected systems and the internal network.

Initial Access

Attacker finds an exposed Langflow instance and sends a crafted request to the vulnerable endpoint without authentication.

AML.T0049

Execution

Injected special elements are passed to an OS command or code interpreter, yielding arbitrary code execution on the host.

AML.T0050

Credential Access

Attacker harvests LLM API keys, vector database and cloud credentials stored in the Langflow environment.

AML.T0055

Impact

Attacker tampers with flows, exfiltrates processed data and pivots into connected systems and the internal network.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
156.0KPushed 6d ago18% patched~66d to patchFull package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

0.7%

chance of exploitation in 30 days

Higher than 55% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade IBM Langflow OSS to a fixed release above 1.12.3 as specified in the IBM advisory (https://www.ibm.com/support/pages/node/7293015). 2) Until patched, remove public exposure and place Langflow behind a VPN, reverse proxy with authentication, or IP allowlist. 3) Run Langflow as a non-root user in a container with minimal privileges, restricted egress and no host mounts. 4) Rotate all LLM, vector DB and cloud credentials stored in or reachable from Langflow instances that were exposed. 5) Monitor for unexpected child processes spawned by the Langflow process, anomalous outbound connections, and unusual requests to flow-execution or component-validation endpoints. 6) Inventory all Langflow deployments, including shadow and developer instances.

How is it classified?

Code ExecutionSupply ChainFrameworkAgentAML.T0049- Exploit Public-Facing Application AML.T0050- Command and Scripting Interpreter AML.T0055- Unsecured Credentials AML.T0072- Reverse Shell

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.10.3-Suppliers

NIST AI RMF

MANAGE 2.3-Responses to identified AI risks and unknown risks

OWASP LLM Top 10

LLM03-Supply ChainLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-104339?

Is CVE-2026-104339 actively exploited?

No confirmed active exploitation of CVE-2026-104339 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-104339?

1) Upgrade IBM Langflow OSS to a fixed release above 1.12.3 as specified in the IBM advisory (https://www.ibm.com/support/pages/node/7293015). 2) Until patched, remove public exposure and place Langflow behind a VPN, reverse proxy with authentication, or IP allowlist. 3) Run Langflow as a non-root user in a container with minimal privileges, restricted egress and no host mounts. 4) Rotate all LLM, vector DB and cloud credentials stored in or reachable from Langflow instances that were exposed. 5) Monitor for unexpected child processes spawned by the Langflow process, anomalous outbound connections, and unusual requests to flow-execution or component-validation endpoints. 6) Inventory all Langflow deployments, including shadow and developer instances.

What systems are affected by CVE-2026-104339?

This vulnerability affects the following AI/ML architecture patterns: LLM orchestration frameworks, Agent frameworks, RAG pipelines, Low-code AI workflow builders.

What is the CVSS score for CVE-2026-104339?

CVE-2026-104339 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 0.75%.

What is the AI security impact?

Affected AI Architectures

LLM orchestration frameworksAgent frameworksRAG pipelinesLow-code AI workflow builders

MITRE ATLAS Techniques

AML.T0049Exploit Public-Facing Application

AML.T0050Command and Scripting Interpreter

AML.T0055Unsecured Credentials

AML.T0072Reverse Shell

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.10.3

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03, LLM06

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.

Exploitation Scenario

An attacker scans for internet-exposed Langflow instances and sends a crafted request containing shell metacharacters or injected code to a vulnerable endpoint. The server executes the injected commands without authentication. The attacker establishes a reverse shell, reads environment variables and the credential store to steal LLM provider and vector database keys, then modifies existing flows to exfiltrate data processed by the AI workflows and moves laterally into the internal network.

Weaknesses (CWE)

CWE-94Improper Control of Generation of Code ('Code Injection')Primary CWE-94Improper Control of Generation of Code ('Code Injection')

CWE-94 — Improper Control of Generation of Code ('Code Injection'): The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

[Architecture and Design] Refactor your program so that you do not have to dynamically generate code.
[Architecture and Design] Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.