CVE-2026-107326: Langflow: OS command injection allows authenticated RCE

HIGH

Published October 29, 2026

CISO Take

CVE-2026-107326 is an OS command injection flaw (CWE-78) in IBM's Langflow OSS builds 1.0.0 through 1.12.4. Any authenticated user with low privileges can run arbitrary commands on the host over the network, with no user interaction and low complexity (CVSS 8.8). There is no KEV listing, no public exploit and no Nuclei template yet, and no EPSS score has been published, so exploitation is not confirmed. Langflow has been a frequent target for code-execution bugs, and the attack is trivial once an attacker holds any account. Langflow servers usually hold LLM API keys, vector database credentials and cloud tokens. Upgrade to the fixed release listed in the IBM advisory (https://www.ibm.com/support/pages/node/7293016). Until then, restrict Langflow to trusted users and networks, and review who has accounts.

Sources:NVDATLASibm.com

What is the risk?

High. The attack is network-reachable, low complexity, needs only low privileges and no user interaction, and gives full confidentiality, integrity and availability impact (CVSS 8.8). Exploitation likelihood is unknown: no EPSS score, KEV listing, public exploit or scanner template is available. Exposure rises sharply where Langflow is internet-facing, allows open self-registration, or shares accounts across many users. Downstream dependents and package risk data are unavailable, so blast radius is estimated from typical Langflow deployments rather than measured.

How does the attack unfold?

Initial Access

Attacker gains a low-privilege Langflow account through open sign-up, credential theft or phishing.

AML.T0012

Exploitation

Attacker sends input containing shell metacharacters that reach an OS command in the vulnerable component.

AML.T0049

Execution

Injected commands run on the host as the Langflow service account, often as a reverse shell.

AML.T0050

Impact

Attacker steals API keys, credentials and flow data, tampers with workflows and pivots into connected systems.

AML.T0025

Initial Access

Attacker gains a low-privilege Langflow account through open sign-up, credential theft or phishing.

AML.T0012

Exploitation

Attacker sends input containing shell metacharacters that reach an OS command in the vulnerable component.

AML.T0049

Execution

Injected commands run on the host as the Langflow service account, often as a reverse shell.

AML.T0050

Impact

Attacker steals API keys, credentials and flow data, tampers with workflows and pivots into connected systems.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
156.0KPushed 6d ago18% patched~66d to patchFull package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.7%

chance of exploitation in 30 days

Higher than 53% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade to the fixed version specified in the IBM advisory (https://www.ibm.com/support/pages/node/7293016), and confirm the installed version is above 1.12.4. 2) Until patched, remove Langflow from the public internet, put it behind a VPN or an authenticating reverse proxy, and disable open sign-up. 3) Audit and prune user accounts, and enforce strong authentication. 4) Run Langflow as an unprivileged user in a container with a restricted filesystem and egress filtering. 5) Rotate LLM API keys, database credentials and cloud tokens stored on any exposed instance. 6) Monitor for unexpected child processes spawned by the Langflow process, odd outbound connections and anomalous flow or component edits.

How is it classified?

Code ExecutionFrameworkAgentAML.T0012- Valid Accounts AML.T0049- Exploit Public-Facing Application AML.T0050- Command and Scripting Interpreter

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Respond to previously unknown risks

OWASP LLM Top 10

LLM05-Improper Output Handling

Frequently Asked Questions

What is CVE-2026-107326?

Is CVE-2026-107326 actively exploited?

No confirmed active exploitation of CVE-2026-107326 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-107326?

1) Upgrade to the fixed version specified in the IBM advisory (https://www.ibm.com/support/pages/node/7293016), and confirm the installed version is above 1.12.4. 2) Until patched, remove Langflow from the public internet, put it behind a VPN or an authenticating reverse proxy, and disable open sign-up. 3) Audit and prune user accounts, and enforce strong authentication. 4) Run Langflow as an unprivileged user in a container with a restricted filesystem and egress filtering. 5) Rotate LLM API keys, database credentials and cloud tokens stored on any exposed instance. 6) Monitor for unexpected child processes spawned by the Langflow process, odd outbound connections and anomalous flow or component edits.

What systems are affected by CVE-2026-107326?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines, low-code LLM orchestration, LLM application servers.

What is the CVSS score for CVE-2026-107326?

CVE-2026-107326 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.70%.

What is the AI security impact?

Affected AI Architectures

agent frameworksRAG pipelineslow-code LLM orchestrationLLM application servers

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0049Exploit Public-Facing Application

AML.T0050Command and Scripting Interpreter

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM05

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.

Exploitation Scenario

An attacker obtains low-privilege access to a Langflow instance, for example through open registration, a phished account or leaked credentials. They send a request that reaches the vulnerable component and inject shell metacharacters into a parameter passed to an OS command. The injected command runs on the server, giving a reverse shell. From there the attacker reads environment variables and stored credentials, exfiltrates API keys and proprietary flows, and moves laterally to connected vector databases and cloud services.

Weaknesses (CWE)

CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Primary CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-78 — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'): The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

[Architecture and Design] If at all possible, use library calls rather than external processes to recreate the desired functionality.
[Architecture and Design, Operation] Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software. OS-level examples include the Unix chroot jail, AppArmor, and SELinux. In general, managed code may provide some protection. For example, java.io.FilePermission in the Java SecurityManager allows the software to specify restrictions on file operations. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of the application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.