CVE-2026-107328: Langflow: code injection via eval/exec allows authenticated RCE

HIGH

Published October 29, 2026

CISO Take

IBM Langflow OSS 1.0.0 through 1.12.4 contains a code injection flaw (CWE-94) where user-controlled input reaches eval/exec, letting any authenticated user run arbitrary code on the Langflow server. The CVSS of 9.9 reflects a scope change: low-privilege access over the network, with no user interaction, can compromise the host and everything it connects to, including LLM API keys, vector stores and downstream data sources. No EPSS score, public exploit, Nuclei template or KEV listing exists yet, so exploitation is unconfirmed. Langflow code-execution flaws have been attractive targets before, and the fix is published in IBM's advisory, so treat this as high priority. Upgrade to the fixed release listed in the IBM advisory (https://www.ibm.com/support/pages/node/7293016), restrict Langflow to trusted networks, and rotate any credentials stored in affected instances.

Sources:NVDibm.comATLAS

What is the risk?

Critical. The attack is network-reachable, low complexity and needs only low privileges (any valid account, including self-registered or shared accounts), with no user interaction. Scope is changed, so compromise of the Langflow process extends to the host and connected systems. Current exploitation likelihood is unquantified: EPSS is N/A, there is no public exploit, no scanner template and no KEV entry. Risk rises sharply if instances are internet-exposed, run with open sign-up, or share low-privilege accounts widely. Confidence: MEDIUM, because it rests on the NVD description and the vendor advisory only.

How does the attack unfold?

Initial Access

Attacker authenticates to a reachable Langflow instance with a low-privilege account.

AML.T0012

Exploitation

Attacker submits crafted input that reaches eval/exec unsanitized, triggering arbitrary code execution on the server.

AML.T0049

Credential Access

Injected code reads environment variables and config files to harvest LLM API keys and database credentials.

AML.T0055

Impact

Attacker pivots to connected vector stores and internal services, exfiltrating data and tampering with flows.

AML.T0025

Initial Access

Attacker authenticates to a reachable Langflow instance with a low-privilege account.

AML.T0012

Exploitation

Attacker submits crafted input that reaches eval/exec unsanitized, triggering arbitrary code execution on the server.

AML.T0049

Credential Access

Injected code reads environment variables and config files to harvest LLM API keys and database credentials.

AML.T0055

Impact

Attacker pivots to connected vector stores and internal services, exfiltrating data and tampering with flows.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
156.0KPushed 6d ago18% patched~66d to patchFull package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.9%

chance of exploitation in 30 days

Higher than 58% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade Langflow OSS beyond 1.12.4 to the fixed version named in the IBM advisory (https://www.ibm.com/support/pages/node/7293016). 2) Until patched, remove Langflow from the public internet, place it behind a VPN or an authenticating reverse proxy, and disable open registration. 3) Audit and reduce the accounts that can create or edit flows and custom components. 4) Run Langflow in a container with a non-root user, a read-only filesystem where possible, minimal egress and no cloud-admin identity. 5) Rotate LLM provider keys, database credentials and other secrets reachable from affected hosts. 6) Detection: monitor for unexpected child processes spawned by the Langflow process, outbound connections from the server to unfamiliar hosts, and API calls that submit or modify custom code or component definitions.

How is it classified?

Code ExecutionFrameworkAgentAML.T0012- Valid Accounts AML.T0049- Exploit Public-Facing Application AML.T0050- Command and Scripting Interpreter AML.T0055- Unsecured Credentials

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responses to previously unknown risks

OWASP LLM Top 10

LLM03-Supply ChainLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-107328?

Is CVE-2026-107328 actively exploited?

No confirmed active exploitation of CVE-2026-107328 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-107328?

1) Upgrade Langflow OSS beyond 1.12.4 to the fixed version named in the IBM advisory (https://www.ibm.com/support/pages/node/7293016). 2) Until patched, remove Langflow from the public internet, place it behind a VPN or an authenticating reverse proxy, and disable open registration. 3) Audit and reduce the accounts that can create or edit flows and custom components. 4) Run Langflow in a container with a non-root user, a read-only filesystem where possible, minimal egress and no cloud-admin identity. 5) Rotate LLM provider keys, database credentials and other secrets reachable from affected hosts. 6) Detection: monitor for unexpected child processes spawned by the Langflow process, outbound connections from the server to unfamiliar hosts, and API calls that submit or modify custom code or component definitions.

What systems are affected by CVE-2026-107328?

This vulnerability affects the following AI/ML architecture patterns: Agent frameworks, RAG pipelines, LLM workflow orchestration, Low-code AI application builders, Multi-tenant AI platforms.

What is the CVSS score for CVE-2026-107328?

CVE-2026-107328 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.85%.

What is the AI security impact?

Affected AI Architectures

Agent frameworksRAG pipelinesLLM workflow orchestrationLow-code AI application buildersMulti-tenant AI platforms

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0049Exploit Public-Facing Application

AML.T0050Command and Scripting Interpreter

AML.T0055Unsecured Credentials

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03, LLM06

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of code in eval/exec.

Exploitation Scenario

An attacker obtains or registers a low-privilege Langflow account, for example on an instance with open sign-up or through a phished or reused credential. They submit a crafted flow, component or API request whose code or expression parameter is passed to eval/exec without neutralization. The payload runs in the Langflow server process, where the attacker reads environment variables holding LLM API keys and database credentials, opens a reverse shell and then moves to connected vector databases and internal services, exfiltrating proprietary documents indexed for RAG.

Weaknesses (CWE)

CWE-94Improper Control of Generation of Code ('Code Injection')Primary CWE-94Improper Control of Generation of Code ('Code Injection')

CWE-94 — Improper Control of Generation of Code ('Code Injection'): The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

[Architecture and Design] Refactor your program so that you do not have to dynamically generate code.
[Architecture and Design] Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.