CVE-2026-12946: Langflow unsanitized code input

CISO Take

IBM Langflow OSS versions 1.0.0 through 1.10.0 fail to properly control code supplied via user input, letting a low-privileged, authenticated attacker inject and execute arbitrary code on the host with no user interaction required. This scores a near-maximum 9.9 CVSS with a changed scope, meaning a successful exploit can compromise resources beyond the vulnerable component itself, which is especially dangerous given Langflow is used to build and orchestrate LLM agent workflows that often hold API keys, database credentials, and access to downstream tools. There is no known public exploit or Nuclei template yet, no CISA KEV listing, and no EPSS score to gauge real-world exploitation probability, but low attack complexity plus a CWE-94 code injection root cause makes this trivial to weaponize once details circulate. Any team running self-hosted Langflow should patch beyond 1.10.0 immediately, treat any instance exposed to untrusted or multi-tenant users as compromised until patched, and audit logs for anomalous code execution or outbound connections from the Langflow host in the interim.

Sources: NVD ibm.com ATLAS

What is the risk?

Critical risk. CVSS 3.1 base score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) reflects network-exploitable, low-complexity code execution requiring only low privileges and no user interaction, with a scope change indicating impact can extend beyond the Langflow process to the underlying host or connected systems. Full compromise of confidentiality, integrity, and availability is possible. Mitigating factors: no confirmed active exploitation (not in CISA KEV), no public PoC or scanner signature identified yet, and EPSS data is unavailable. However, the combination of a trivially exploitable code injection primitive (CWE-94) in a widely adopted open-source LLM agent-building framework means the exploitation likelihood should be treated as high once technical details or a PoC surface, particularly for internet-facing or multi-tenant deployments.

How does the attack unfold?

Initial Access

Attacker obtains or has low-privilege authenticated access to a self-hosted, network-reachable Langflow instance.

AML.T0049

Code Injection

Attacker submits unsanitized user input containing malicious code through a Langflow component or flow configuration field.

AML.T0050

Execution

Langflow fails to control the injected code and executes it on the underlying host, granting the attacker a foothold.

Impact

Attacker leverages RCE to exfiltrate credentials and pipeline data or pivot into connected systems, compromising confidentiality, integrity, and availability.

Initial Access

Attacker obtains or has low-privilege authenticated access to a self-hosted, network-reachable Langflow instance.

AML.T0049

Code Injection

Attacker submits unsanitized user input containing malicious code through a Langflow component or flow configuration field.

AML.T0050

Execution

Langflow fails to control the injected code and executes it on the underlying host, granting the attacker a foothold.

Impact

Attacker leverages RCE to exfiltrate credentials and pipeline data or pivot into connected systems, compromising confidentiality, integrity, and availability.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
152.4K Pushed 4d ago 27% patched ~70d to patch Full package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

9.9 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Changed

C High

I High

A High

What should I do?

1 step

Upgrade Langflow to a version beyond 1.10.0 as soon as a patched release is confirmed available from IBM/Langflow maintainers; track the vendor advisory at ibm.com for the fix version. Until patched, restrict Langflow instances to trusted, authenticated users only and remove any public internet exposure — place instances behind a VPN or IP allowlist. Audit and disable or tightly sandbox any custom code execution components/nodes that accept free-form user input. Run Langflow in a container or VM with minimal privileges and no direct access to sensitive credentials or production data stores, and monitor process execution and outbound network activity on Langflow hosts for anomalies. Rotate any API keys or secrets accessible to the Langflow environment if compromise is suspected.

How is it classified?

Code Execution Auth Bypass Framework Agent AML.T0049 - Exploit Public-Facing Application AML.T0050 - Command and Scripting Interpreter

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6 - AI system security

NIST AI RMF

MEASURE 2.7 - AI system security and resilience evaluation

Frequently Asked Questions

What is CVE-2026-12946?

IBM Langflow OSS versions 1.0.0 through 1.10.0 fail to properly control code supplied via user input, letting a low-privileged, authenticated attacker inject and execute arbitrary code on the host with no user interaction required. This scores a near-maximum 9.9 CVSS with a changed scope, meaning a successful exploit can compromise resources beyond the vulnerable component itself, which is especially dangerous given Langflow is used to build and orchestrate LLM agent workflows that often hold API keys, database credentials, and access to downstream tools. There is no known public exploit or Nuclei template yet, no CISA KEV listing, and no EPSS score to gauge real-world exploitation probability, but low attack complexity plus a CWE-94 code injection root cause makes this trivial to weaponize once details circulate. Any team running self-hosted Langflow should patch beyond 1.10.0 immediately, treat any instance exposed to untrusted or multi-tenant users as compromised until patched, and audit logs for anomalous code execution or outbound connections from the Langflow host in the interim.

Is CVE-2026-12946 actively exploited?

No confirmed active exploitation of CVE-2026-12946 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-12946?

Upgrade Langflow to a version beyond 1.10.0 as soon as a patched release is confirmed available from IBM/Langflow maintainers; track the vendor advisory at ibm.com for the fix version. Until patched, restrict Langflow instances to trusted, authenticated users only and remove any public internet exposure — place instances behind a VPN or IP allowlist. Audit and disable or tightly sandbox any custom code execution components/nodes that accept free-form user input. Run Langflow in a container or VM with minimal privileges and no direct access to sensitive credentials or production data stores, and monitor process execution and outbound network activity on Langflow hosts for anomalies. Rotate any API keys or secrets accessible to the Langflow environment if compromise is suspected.

What systems are affected by CVE-2026-12946?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines, LLM orchestration/workflow builders, custom code execution components.

What is the CVSS score for CVE-2026-12946?

CVE-2026-12946 has a CVSS v3.1 base score of 9.9 (CRITICAL).

What is the AI security impact?

Affected AI Architectures

agent frameworksRAG pipelinesLLM orchestration/workflow builderscustom code execution components

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0050 Command and Scripting Interpreter

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MEASURE 2.7

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to inject arbitrary code on the system, due to the improper control of user input code.

Exploitation Scenario

An attacker obtains or is granted a low-privileged account on a self-hosted, internet-facing Langflow instance (e.g., a shared internal AI tooling platform or a misconfigured public deployment). Using Langflow's flow-building interface, the attacker crafts a component or input field containing malicious code that the application fails to sanitize, and Langflow executes it directly on the host. From there, the attacker pivots to read environment variables containing LLM API keys and database credentials, exfiltrates data flowing through connected RAG/agent pipelines, or uses the compromised host as a foothold into the broader internal network.

Weaknesses (CWE)

CWE-94 Improper Control of Generation of Code ('Code Injection') CWE-94 Improper Control of Generation of Code ('Code Injection')

CWE-94 — Improper Control of Generation of Code ('Code Injection'): The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

[Architecture and Design] Refactor your program so that you do not have to dynamically generate code.
[Architecture and Design] Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.