CVE-2026-110309: Langflow: code injection allows authenticated RCE

HIGH

Published October 29, 2026

CISO Take

IBM Langflow OSS versions 1.0.0 through 1.12.4 contain a code generation flaw (CWE-94) that lets any authenticated user run arbitrary commands on the server. The CVSS score is 8.8 and exploitation is network-reachable, low complexity and needs no user interaction, so any valid account is enough. No public exploit, Nuclei template or KEV listing exists yet, and no EPSS score is available, so there is no evidence of active exploitation today. Langflow servers typically hold LLM API keys, vector database credentials and connector secrets, so a successful attack gives access to all of them. Check your Langflow version now, apply the fix described in IBM's advisory (node 7293016), restrict instance access to trusted users, and rotate stored credentials if you can't patch quickly.

Sources:NVDATLASibm.com

What is the risk?

High. The vector is network, low complexity, low privileges and no user interaction, with high impact on confidentiality, integrity and availability. The main limiting factor is the need for an authenticated account. That barrier is weak on instances with open sign-up, shared team accounts, leaked credentials or exposed API keys. There is no KEV listing, public exploit or scanner template at publication, and EPSS is not available, so exploitation likelihood is unquantified. Exploit development for code injection flaws in low-code AI builders tends to be fast once details are public, so treat the risk as rising.

How does the attack unfold?

Initial Access

Attacker obtains a low-privileged Langflow account through open sign-up, credential theft or a leaked API key.

AML.T0012

Exploitation

Attacker submits crafted input that the server turns into executable code, exploiting the code injection flaw (CWE-94).

AML.T0049

Execution

Arbitrary commands run on the Langflow host with the service's privileges, enabling a shell and credential harvesting.

AML.T0050

Impact

Attacker steals LLM and data store credentials, tampers with flows and pivots into connected systems.

Initial Access

Attacker obtains a low-privileged Langflow account through open sign-up, credential theft or a leaked API key.

AML.T0012

Exploitation

Attacker submits crafted input that the server turns into executable code, exploiting the code injection flaw (CWE-94).

AML.T0049

Execution

Arbitrary commands run on the Langflow host with the service's privileges, enabling a shell and credential harvesting.

AML.T0050

Impact

Attacker steals LLM and data store credentials, tampers with flows and pivots into connected systems.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
156.0KPushed 6d ago18% patched~66d to patchFull package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.6%

chance of exploitation in 30 days

Higher than 47% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade Langflow to the fixed release listed in the IBM advisory at https://www.ibm.com/support/pages/node/7293016. 2) Until patched, restrict network access to Langflow (VPN, IP allowlist, reverse proxy with SSO) and disable open registration. 3) Review and minimize user accounts and API keys, and rotate any credentials stored in Langflow (LLM, vector DB, cloud) if compromise is suspected. 4) Run Langflow as an unprivileged user in a hardened container with minimal egress and no access to sensitive host mounts. 5) Detect: monitor for unexpected child processes spawned by the Langflow service, outbound connections to unfamiliar hosts, and flow or component edits by unusual users. Review API logs for abnormal code or component validation requests.

How is it classified?

Code ExecutionFrameworkAgentAML.T0012- Valid Accounts AML.T0049- Exploit Public-Facing Application AML.T0050- Command and Scripting Interpreter

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Procedures to respond to and recover from previously unknown risks

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-110309?

Is CVE-2026-110309 actively exploited?

No confirmed active exploitation of CVE-2026-110309 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-110309?

1) Upgrade Langflow to the fixed release listed in the IBM advisory at https://www.ibm.com/support/pages/node/7293016. 2) Until patched, restrict network access to Langflow (VPN, IP allowlist, reverse proxy with SSO) and disable open registration. 3) Review and minimize user accounts and API keys, and rotate any credentials stored in Langflow (LLM, vector DB, cloud) if compromise is suspected. 4) Run Langflow as an unprivileged user in a hardened container with minimal egress and no access to sensitive host mounts. 5) Detect: monitor for unexpected child processes spawned by the Langflow service, outbound connections to unfamiliar hosts, and flow or component edits by unusual users. Review API logs for abnormal code or component validation requests.

What systems are affected by CVE-2026-110309?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines, LLM workflow orchestration, low-code AI builders.

What is the CVSS score for CVE-2026-110309?

CVE-2026-110309 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.57%.

What is the AI security impact?

Affected AI Architectures

agent frameworksRAG pipelinesLLM workflow orchestrationlow-code AI builders

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0049Exploit Public-Facing Application

AML.T0050Command and Scripting Interpreter

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary commands due to improper control of code generation.

Exploitation Scenario

An attacker gets a low-privileged Langflow account through open sign-up, a phished employee or a leaked API key. They submit crafted input to a code-handling feature, for example a custom component or flow definition, which the server turns into executable code without proper validation. The injected code runs with the privileges of the Langflow service. The attacker reads environment variables to steal LLM provider and vector database keys, then installs a reverse shell for persistence. Finally they pivot into the cloud account or internal data stores connected to the AI workflows.

Weaknesses (CWE)

CWE-94Improper Control of Generation of Code ('Code Injection')Primary CWE-94Improper Control of Generation of Code ('Code Injection')

CWE-94 — Improper Control of Generation of Code ('Code Injection'): The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

[Architecture and Design] Refactor your program so that you do not have to dynamically generate code.
[Architecture and Design] Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.