CVE-2026-12944: Langflow: SSRF-driven root RCE via component imports

CRITICAL

Published September 14, 2026

CISO Take

Langflow OSS 1.0.0 through 1.10.0 lets a low-privileged authenticated user submit custom components that import socket or urllib and run arbitrary Python as root (UID=0) on the server, with the built-in code scanner wrongly reporting the component as "validated". The CVSS of 9.6 reflects a changed scope: attackers can steal AWS credentials via IMDSv1, read container files, and pivot to internal services such as PostgreSQL and Redis. Near-term exploitation pressure is modest, since EPSS is 0.00429 (top 65%), the CVE is not in CISA KEV, there is no public exploit or Nuclei template, and CISA SSVC says TRACK. Even so, Langflow servers commonly hold LLM API keys and cloud roles, so the impact is far larger than the score suggests. Apply the fix described in IBM advisory 7278919, enforce IMDSv2 with a hop limit of 1, run the container as non-root, and restrict who can create custom components.

Sources:NVDEPSSibm.comATLASCISA SSVC

What is the risk?

Severity is critical (CVSS 9.6, AV:N/AC:L/PR:L/UI:N/S:C). Exploitation is simple for anyone with a low-privilege account. Likelihood today is moderate to low: EPSS 0.00429, not in KEV, no public exploit or scanner template, SSVC TRACK. Impact is high for confidentiality and integrity because of root execution, cloud credential theft, and lateral movement. Exposure depends on whether Langflow is internet-facing or open to many internal users, and on whether the host uses IMDSv1. Downstream dependents and package risk data are unavailable, so blast radius is unquantified.

How does the attack unfold?

Initial Access

An attacker with a low-privilege Langflow account submits a custom component containing socket or urllib imports.

AML.T0049

Code Execution

The flawed scanner returns validated: true and the component runs arbitrary Python as root on the server.

AML.T0050

Credential Access

The code queries the IMDSv1 endpoint to steal AWS IAM role credentials and reads sensitive files from the container.

AML.T0055

Lateral Movement and Impact

The attacker pivots to PostgreSQL and Redis on the Docker network and uses the stolen cloud role to access further resources.

AML.T0075

Initial Access

An attacker with a low-privilege Langflow account submits a custom component containing socket or urllib imports.

AML.T0049

Code Execution

The flawed scanner returns validated: true and the component runs arbitrary Python as root on the server.

AML.T0050

Credential Access

The code queries the IMDSv1 endpoint to steal AWS IAM role credentials and reads sensitive files from the container.

AML.T0055

Lateral Movement and Impact

The attacker pivots to PostgreSQL and Redis on the Docker network and uses the stolen cloud role to access further resources.

AML.T0075

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
156.2KPushed 3d ago18% patched~75d to patchFull package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

9.6 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 33% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SChanged

CHigh

IHigh

ANone

What should I do?

1 step

1) Upgrade to the fixed IBM Langflow OSS release per https://www.ibm.com/support/pages/node/7278919; versions 1.0.0 to 1.10.0 are affected. 2) Enforce IMDSv2 and set the metadata hop limit to 1 so containers cannot reach IMDS. 3) Run Langflow as a non-root user with a read-only filesystem and drop unneeded capabilities. 4) Limit custom component creation to trusted roles and do not rely on the built-in validation result. 5) Segment the Docker network so Langflow cannot reach PostgreSQL and Redis unless required, and use egress filtering. 6) Apply least privilege to the instance IAM role and rotate any credentials, API keys, and database passwords that could have been exposed. 7) Detect by reviewing saved components for socket or urllib imports, alerting on requests to 169.254.169.254, monitoring CloudTrail for use of instance-role credentials from unexpected IPs, and watching for unusual outbound connections from Langflow hosts.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code ExecutionData ExtractionAuth BypassFrameworkAgentPluginAML.T0037- Data from Local System AML.T0049- Exploit Public-Facing Application AML.T0050- Command and Scripting Interpreter AML.T0055- Unsecured Credentials AML.T0075- Cloud Service Discovery

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Response to previously unknown risks and mechanisms for disengagement

OWASP LLM Top 10

LLM03-Supply ChainLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-12944?

Is CVE-2026-12944 actively exploited?

No confirmed active exploitation of CVE-2026-12944 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-12944?

1) Upgrade to the fixed IBM Langflow OSS release per https://www.ibm.com/support/pages/node/7278919; versions 1.0.0 to 1.10.0 are affected. 2) Enforce IMDSv2 and set the metadata hop limit to 1 so containers cannot reach IMDS. 3) Run Langflow as a non-root user with a read-only filesystem and drop unneeded capabilities. 4) Limit custom component creation to trusted roles and do not rely on the built-in validation result. 5) Segment the Docker network so Langflow cannot reach PostgreSQL and Redis unless required, and use egress filtering. 6) Apply least privilege to the instance IAM role and rotate any credentials, API keys, and database passwords that could have been exposed. 7) Detect by reviewing saved components for socket or urllib imports, alerting on requests to 169.254.169.254, monitoring CloudTrail for use of instance-role credentials from unexpected IPs, and watching for unusual outbound connections from Langflow hosts.

What systems are affected by CVE-2026-12944?

This vulnerability affects the following AI/ML architecture patterns: Agent frameworks, RAG pipelines, LLM workflow orchestration, Containerized AI platforms on AWS, Low-code AI application builders.

What is the CVSS score for CVE-2026-12944?

CVE-2026-12944 has a CVSS v3.1 base score of 9.6 (CRITICAL). The EPSS exploitation probability is 0.39%.

What is the AI security impact?

Affected AI Architectures

Agent frameworksRAG pipelinesLLM workflow orchestrationContainerized AI platforms on AWSLow-code AI application builders

MITRE ATLAS Techniques

AML.T0037Data from Local System

AML.T0049Exploit Public-Facing Application

AML.T0050Command and Scripting Interpreter

AML.T0055Unsecured Credentials

AML.T0075Cloud Service Discovery

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03, LLM06

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.10.0 can allow attackers to execute arbitrary Python code with root privileges (UID=0) on the Langflow server by submitting components containing socket or urllib imports. This enables: (1) AWS credential theft via IMDSv1 SSRF with full IAM role permissions, (2) arbitrary file exfiltration from the container filesystem, and (3) lateral movement to internal services (PostgreSQL, Redis) within the Docker network. The scanner incorrectly returns "validated": true, providing a false security signal.

Exploitation Scenario

An attacker obtains a low-privilege Langflow account, through self-registration, a leaked token, or a shared deployment. They create a custom component that imports urllib and queries the IMDSv1 endpoint, which returns temporary IAM role credentials. The scanner marks the component as validated, so it runs without friction. As root, the same component reads environment files and secrets from the container, then uses socket to connect to PostgreSQL and Redis on the Docker network. The attacker exfiltrates the data and uses the stolen AWS credentials from outside to reach S3 buckets, model stores, and other cloud resources.

Weaknesses (CWE)

CWE-918Server-Side Request ForgeryPrimary CWE-918Server-Side Request Forgery

CWE-918 — Server-Side Request Forgery: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

[Implementation, Operation] If there is a known list of applications, IP, hostname, and/or domains to which the product is allowed to communicate, then use allowlists to ensure that outgoing requests are restricted to these known entities. The allowlists could be in the application code or possibly enforced by firewalls or network segmentation [REF-1511].
[Implementation, Operation] If the product is expected to be able to connect to arbitrary IP addresses or domains, consider using a denylist that includes private network addresses, internal domain names, etc. The denylist could be in the application code or possibly enforced by firewalls or network segmentation [REF-1511].

Source: MITRE CWE corpus.