CVE-2026-107327: Langflow: missing authorization allows authenticated RCE

HIGH

Published October 29, 2026

CISO Take

IBM Langflow OSS versions 1.0.0 through 1.12.4 contain a missing-authorization flaw (CWE-862) that lets any low-privileged authenticated user execute arbitrary code on the server, scoring CVSS 9.9 with a scope change. No active exploitation is recorded: the CVE is not in CISA KEV, no public exploit or Nuclei template is known, and EPSS data is not yet available. Even so, the attack is network-reachable, low complexity and needs no user interaction. Langflow has a history of high-value exploitation, and a scope change means a compromise can reach the host, connected databases, vector stores and LLM API keys. Upgrade to the fixed release named in the IBM advisory (https://www.ibm.com/support/pages/node/7293016), restrict who holds Langflow accounts, and keep instances off the public internet until patched.

Sources:NVDibm.comATLAS

What is the risk?

Critical. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) means any user with a valid low-privilege account can reach code execution with no special conditions. The scope change implies impact beyond the Langflow component itself. Exploit availability is currently unknown or none, and EPSS and SSVC data are unavailable, so the likelihood estimate carries LOW confidence. Risk rises sharply for instances with open self-registration, shared multi-tenant deployments, or internet exposure. The affected version range is wide (1.0.0 to 1.12.4), so most deployed versions are in scope.

How does the attack unfold?

Initial Access

Attacker obtains a low-privilege Langflow account via signup, credential theft or an exposed instance.

AML.T0012

Exploitation

Attacker calls an endpoint lacking authorization checks to run arbitrary code on the server.

AML.T0049

Credential Access

Attacker harvests LLM API keys and database credentials stored in the Langflow environment.

AML.T0055

Impact

Attacker pivots to connected data stores and internal systems, exfiltrating data or tampering with flows.

AML.T0025

Initial Access

Attacker obtains a low-privilege Langflow account via signup, credential theft or an exposed instance.

AML.T0012

Exploitation

Attacker calls an endpoint lacking authorization checks to run arbitrary code on the server.

AML.T0049

Credential Access

Attacker harvests LLM API keys and database credentials stored in the Langflow environment.

AML.T0055

Impact

Attacker pivots to connected data stores and internal systems, exfiltrating data or tampering with flows.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
156.0KPushed 6d ago18% patched~66d to patchFull package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.7%

chance of exploitation in 30 days

Higher than 52% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade Langflow OSS to the fixed version listed in the IBM advisory (node/7293016); versions 1.0.0 through 1.12.4 are vulnerable. 2) Until patched, disable open registration, remove unused accounts, and restrict access with a VPN, IP allowlist or authenticating reverse proxy. 3) Run Langflow in a hardened container with a non-root user, minimal egress and no host mounts. 4) Rotate LLM API keys, database credentials and other secrets stored in or reachable from Langflow if compromise is suspected. 5) Detect: review API logs for low-privileged users calling privileged or code-related endpoints, and watch for unexpected child processes, outbound connections or file changes on the Langflow host.

How is it classified?

Code ExecutionAuth BypassFrameworkAgentAML.T0012- Valid Accounts AML.T0049- Exploit Public-Facing Application AML.T0050- Command and Scripting Interpreter AML.T0055- Unsecured Credentials

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.10.3-Suppliers

NIST AI RMF

MANAGE 2.3-Response to previously unknown risks

OWASP LLM Top 10

LLM03-Supply ChainLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-107327?

Is CVE-2026-107327 actively exploited?

No confirmed active exploitation of CVE-2026-107327 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-107327?

1) Upgrade Langflow OSS to the fixed version listed in the IBM advisory (node/7293016); versions 1.0.0 through 1.12.4 are vulnerable. 2) Until patched, disable open registration, remove unused accounts, and restrict access with a VPN, IP allowlist or authenticating reverse proxy. 3) Run Langflow in a hardened container with a non-root user, minimal egress and no host mounts. 4) Rotate LLM API keys, database credentials and other secrets stored in or reachable from Langflow if compromise is suspected. 5) Detect: review API logs for low-privileged users calling privileged or code-related endpoints, and watch for unexpected child processes, outbound connections or file changes on the Langflow host.

What systems are affected by CVE-2026-107327?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines, LLM workflow orchestration, low-code AI application builders, multi-tenant AI platforms.

What is the CVSS score for CVE-2026-107327?

CVE-2026-107327 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.67%.

What is the AI security impact?

Affected AI Architectures

agent frameworksRAG pipelinesLLM workflow orchestrationlow-code AI application buildersmulti-tenant AI platforms

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0049Exploit Public-Facing Application

AML.T0050Command and Scripting Interpreter

AML.T0055Unsecured Credentials

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.10.3

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03, LLM06

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to missing authorization.

Exploitation Scenario

An attacker obtains or registers a low-privilege Langflow account, for example through a trial signup, phished credentials or an exposed instance with self-registration. They call an API endpoint that fails to check authorization and use it to run arbitrary code on the server. They then read environment variables and the credential store to take LLM API keys and database passwords, and plant a reverse shell for persistence. From the host they move laterally to the vector database and internal services, exfiltrating proprietary documents and abusing the keys for costly inference.

Weaknesses (CWE)

CWE-862Missing AuthorizationPrimary CWE-862Missing Authorization

CWE-862 — Missing Authorization: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.