CVE-2026-110186: Langflow: code injection allows unauthenticated RCE

CRITICAL

Published October 29, 2026

CISO Take

IBM Langflow OSS 1.0.0 through 1.12.8 has a code injection flaw (CWE-94) that lets a remote, unauthenticated attacker run arbitrary code on the server over the network with no user interaction (CVSS 9.8). Langflow instances typically hold LLM API keys, vector database credentials and cloud tokens, so one compromised host can expose an organization's whole AI stack. It is not in CISA KEV, no public exploit or Nuclei template is known, and no EPSS score is available yet. Langflow's history of similar code-execution bugs, which attackers have quickly weaponized, means this should still be treated as high priority. Upgrade to the fixed version listed in the IBM advisory (node 7294467), and take any internet-exposed instance offline or put it behind authentication until it is patched.

Sources:NVDibm.comATLAS

What is the risk?

Critical. The attack is network-reachable, low complexity, and needs no privileges or user interaction, with full confidentiality, integrity and availability impact. Exploitation likelihood cannot be quantified because there is no EPSS data, no KEV listing, no public PoC and no SSVC decision, but the bug class is easy to weaponize once details are published. Risk is highest for internet-exposed Langflow servers and shared AI development environments. Confidence: MEDIUM, since the description is brief and the advisory details are not independently verified.

How does the attack unfold?

Initial Access

Attacker finds an exposed Langflow server running a vulnerable version and sends a crafted unauthenticated request.

AML.T0049

Code Execution

Improperly controlled code generation causes attacker-supplied code to run on the host.

AML.T0050

Credential Access

Attacker harvests LLM API keys, database credentials and cloud tokens from the environment and configuration.

AML.T0055

Impact

Attacker tampers with flows, steals data and pivots into connected AI and internal systems.

Initial Access

Attacker finds an exposed Langflow server running a vulnerable version and sends a crafted unauthenticated request.

AML.T0049

Code Execution

Improperly controlled code generation causes attacker-supplied code to run on the host.

AML.T0050

Credential Access

Attacker harvests LLM API keys, database credentials and cloud tokens from the environment and configuration.

AML.T0055

Impact

Attacker tampers with flows, steals data and pivots into connected AI and internal systems.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
156.0KPushed 6d ago18% patched~66d to patchFull package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

0.6%

chance of exploitation in 30 days

Higher than 50% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade to the patched Langflow release named in the IBM advisory (https://www.ibm.com/support/pages/node/7294467). 2) Until patched, remove public exposure and restrict access with a VPN, an authenticating reverse proxy or IP allowlists. 3) Run Langflow as a low-privilege user in an isolated container or network segment with minimal egress. 4) Rotate all LLM, vector database and cloud credentials stored on or reachable from affected instances. 5) Hunt for unexpected child processes, outbound connections, new or modified flows and custom components, and review web logs for unusual requests to code-handling endpoints. 6) Inventory all Langflow deployments, including shadow and developer instances, running 1.0.0 to 1.12.8.

How is it classified?

Code ExecutionSupply ChainFrameworkAgentRAGAML.T0049- Exploit Public-Facing Application AML.T0050- Command and Scripting Interpreter AML.T0055- Unsecured Credentials AML.T0072- Reverse Shell

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responses to identified AI risks and unknown risks

OWASP LLM Top 10

LLM03-Supply ChainLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-110186?

Is CVE-2026-110186 actively exploited?

No confirmed active exploitation of CVE-2026-110186 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-110186?

1) Upgrade to the patched Langflow release named in the IBM advisory (https://www.ibm.com/support/pages/node/7294467). 2) Until patched, remove public exposure and restrict access with a VPN, an authenticating reverse proxy or IP allowlists. 3) Run Langflow as a low-privilege user in an isolated container or network segment with minimal egress. 4) Rotate all LLM, vector database and cloud credentials stored on or reachable from affected instances. 5) Hunt for unexpected child processes, outbound connections, new or modified flows and custom components, and review web logs for unusual requests to code-handling endpoints. 6) Inventory all Langflow deployments, including shadow and developer instances, running 1.0.0 to 1.12.8.

What systems are affected by CVE-2026-110186?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines, LLM workflow orchestration, low-code AI development platforms.

What is the CVSS score for CVE-2026-110186?

CVE-2026-110186 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 0.62%.

What is the AI security impact?

Affected AI Architectures

agent frameworksRAG pipelinesLLM workflow orchestrationlow-code AI development platforms

MITRE ATLAS Techniques

AML.T0049Exploit Public-Facing Application

AML.T0050Command and Scripting Interpreter

AML.T0055Unsecured Credentials

AML.T0072Reverse Shell

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03, LLM06

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to execute arbitrary code due to improper control of code generation.

Exploitation Scenario

An attacker scans for exposed Langflow servers and fingerprints versions 1.0.0 to 1.12.8. They send a crafted request to the vulnerable endpoint that causes the application to generate and run attacker-controlled code. They then open a reverse shell, read environment variables and the credential store to collect LLM and cloud keys, and edit existing flows to quietly exfiltrate prompts and retrieved data. Finally, they use the stolen credentials to reach vector databases and internal systems.

Weaknesses (CWE)

CWE-94Improper Control of Generation of Code ('Code Injection')Primary CWE-94Improper Control of Generation of Code ('Code Injection')

CWE-94 — Improper Control of Generation of Code ('Code Injection'): The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

[Architecture and Design] Refactor your program so that you do not have to dynamically generate code.
[Architecture and Design] Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.