CVE-2026-107329: Langflow: code injection allows authenticated RCE

HIGH

Published October 29, 2026

CISO Take

IBM Langflow OSS versions 1.0.0 through 1.12.4 contain a code injection flaw (CWE-94) that lets any authenticated user execute arbitrary code on the server. The CVSS score is 9.9 with a changed scope, so a compromise can reach well beyond the Langflow process into the host and the credentials and connected systems it holds. No public exploit, Nuclei template or KEV listing exists yet, and EPSS is not yet available. Even so, Langflow's code-execution flaws have drawn attacker interest before, and the barrier here is only a low-privilege account. Identify every Langflow instance, upgrade to the fixed release listed in the IBM advisory (https://www.ibm.com/support/pages/node/7293016), restrict access to trusted networks, and rotate any API keys and secrets stored in the platform if exposure is suspected.

Sources:NVDibm.comATLAS

What is the risk?

Critical. The attack is network-reachable with low complexity, needs only a low-privilege account and no user interaction, and gives full confidentiality, integrity and availability impact with scope change. Exploitation likelihood today is uncertain because there is no EPSS data, no public exploit, no scanner template and no KEV entry. Risk rises sharply if instances allow open self-registration, share accounts, or are exposed to the internet. Langflow normally stores LLM provider keys, vector database credentials and other secrets, which increases the impact of a compromise. These details come from the NVD description and the CVSS vector. The vendor advisory was not reviewed in depth, so the exact vulnerable component is unconfirmed.

How does the attack unfold?

Initial Access

Attacker authenticates to a reachable Langflow instance with a low-privilege account.

AML.T0012

Exploitation

Crafted input to a code-handling feature causes the server to generate and execute attacker-controlled code.

AML.T0049

Execution

Arbitrary commands run on the host with the Langflow service's privileges, giving the attacker a shell.

AML.T0050

Impact

Attacker steals stored LLM and database credentials, tampers with flows, and pivots into connected systems.

AML.T0055

Initial Access

Attacker authenticates to a reachable Langflow instance with a low-privilege account.

AML.T0012

Exploitation

Crafted input to a code-handling feature causes the server to generate and execute attacker-controlled code.

AML.T0049

Execution

Arbitrary commands run on the host with the Langflow service's privileges, giving the attacker a shell.

AML.T0050

Impact

Attacker steals stored LLM and database credentials, tampers with flows, and pivots into connected systems.

AML.T0055

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
156.0KPushed 6d ago18% patched~66d to patchFull package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.9%

chance of exploitation in 30 days

Higher than 58% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Inventory all Langflow deployments and confirm versions; anything from 1.0.0 through 1.12.4 is vulnerable. 2) Upgrade to the fixed version named in the IBM advisory (https://www.ibm.com/support/pages/node/7293016). 3) Until patched, remove internet exposure, place Langflow behind a VPN or an authenticating reverse proxy, disable open registration, and review which accounts exist. 4) Run Langflow in a hardened, least-privilege container with restricted egress and no host mounts. 5) Rotate LLM API keys, database credentials and other secrets stored in Langflow if compromise is suspected. 6) Detect by watching for unexpected child processes spawned by the Langflow service, unusual outbound connections, new or modified flows and custom components, and anomalous activity from low-privilege accounts.

How is it classified?

Code ExecutionFrameworkAgentAML.T0012- Valid Accounts AML.T0049- Exploit Public-Facing Application AML.T0050- Command and Scripting Interpreter AML.T0055- Unsecured Credentials

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responses to identified AI risks and unknown risks

OWASP LLM Top 10

LLM03-Supply ChainLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-107329?

Is CVE-2026-107329 actively exploited?

No confirmed active exploitation of CVE-2026-107329 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-107329?

1) Inventory all Langflow deployments and confirm versions; anything from 1.0.0 through 1.12.4 is vulnerable. 2) Upgrade to the fixed version named in the IBM advisory (https://www.ibm.com/support/pages/node/7293016). 3) Until patched, remove internet exposure, place Langflow behind a VPN or an authenticating reverse proxy, disable open registration, and review which accounts exist. 4) Run Langflow in a hardened, least-privilege container with restricted egress and no host mounts. 5) Rotate LLM API keys, database credentials and other secrets stored in Langflow if compromise is suspected. 6) Detect by watching for unexpected child processes spawned by the Langflow service, unusual outbound connections, new or modified flows and custom components, and anomalous activity from low-privilege accounts.

What systems are affected by CVE-2026-107329?

This vulnerability affects the following AI/ML architecture patterns: Agent frameworks, RAG pipelines, LLM workflow orchestration, Low-code AI application builders, Multi-tenant AI platforms.

What is the CVSS score for CVE-2026-107329?

CVE-2026-107329 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.85%.

What is the AI security impact?

Affected AI Architectures

Agent frameworksRAG pipelinesLLM workflow orchestrationLow-code AI application buildersMulti-tenant AI platforms

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0049Exploit Public-Facing Application

AML.T0050Command and Scripting Interpreter

AML.T0055Unsecured Credentials

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03, LLM06

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code generation.

Exploitation Scenario

An attacker obtains a low-privilege Langflow account, either through self-registration, a phished user, or reused credentials. They submit crafted input to a code-handling feature, such as a custom component or code validation endpoint, which the server evaluates without proper control. The payload runs with the privileges of the Langflow service and opens a reverse shell. The attacker then reads environment variables and the credential store to take LLM provider keys and vector database credentials, and uses them to reach internal data sources and cloud resources. They may also modify existing flows to keep persistence and silently manipulate AI application outputs.

Weaknesses (CWE)

CWE-94Improper Control of Generation of Code ('Code Injection')Primary CWE-94Improper Control of Generation of Code ('Code Injection')

CWE-94 — Improper Control of Generation of Code ('Code Injection'): The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

[Architecture and Design] Refactor your program so that you do not have to dynamically generate code.
[Architecture and Design] Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.