CVE-2026-13448: Langflow unauthenticated RCE

CISO Take

IBM's Langflow OSS ships a public flow-build endpoint designed to run without authentication, and an incomplete denylist in its code-execution filter fails to block several agent components — including CodeActAgentSmolagents and CSVAgent — that can run arbitrary code on the server. Any CISO running Langflow to orchestrate AI agents should treat this as a direct path to full server compromise: the CVSS 8.1 score reflects complete loss of confidentiality, integrity, and availability, and no privileges or user interaction are required, only network access to the build endpoint. There's no EPSS score, public exploit, or Nuclei template yet and it isn't in CISA KEV, but Langflow has a track record of being actively exploited within days of disclosure, so treat the absence of telemetry as a lagging indicator, not reassurance. Attack complexity is rated high because the attacker must know the specific denylist gaps, but that knowledge is now public via this advisory. Patch to a Langflow release beyond 1.10.1 once available, and in the meantime restrict or firewall /api/v1/build_public_tmp/{flow_id}/flow and disable public flow builds if the feature isn't actively used.

Sources: NVD ATLAS ibm.com

What is the risk?

High risk despite the AC:H rating: PR:N and UI:N mean the barrier to entry is just network reachability to a deliberately unauthenticated endpoint, and the impact is a full C:H/I:H/A:H compromise of the Langflow host. Attack complexity is rated high mainly because exploitation depends on knowing which agent components (CodeActAgentSmolagents, CSVAgent, and the OpenAPI-based star agent named in the advisory) evade the denylist — information now disclosed publicly, which will likely lower real-world complexity quickly. No EPSS score or CISA KEV listing exists yet, and no public PoC or Nuclei template has been observed, so near-term mass exploitation is unconfirmed but plausible given Langflow's history of rapid post-disclosure exploitation. Any Langflow instance exposing the public flow-build feature to the internet — a common configuration for demo/embed use cases — should be considered at immediate risk.

How does the attack unfold?

Initial Access

Attacker sends an unauthenticated request to the public flow-build endpoint /api/v1/build_public_tmp/{flow_id}/flow with a crafted flow definition.

AML.T0049

Execution

The flow includes a code-execution-capable agent component (CodeActAgentSmolagents, CSVAgent, or OpenDsStarAgent) missing from the server's denylist, so Langflow builds and runs it, executing attacker code server-side.

AML.T0053

Impact

Attacker achieves full remote code execution on the Langflow host, gaining access to secrets, internal network reachability, and the ability to persist or pivot further.

AML.T0050

Initial Access

Attacker sends an unauthenticated request to the public flow-build endpoint /api/v1/build_public_tmp/{flow_id}/flow with a crafted flow definition.

AML.T0049

Execution

The flow includes a code-execution-capable agent component (CodeActAgentSmolagents, CSVAgent, or OpenDsStarAgent) missing from the server's denylist, so Langflow builds and runs it, executing attacker code server-side.

AML.T0053

Impact

Attacker achieves full remote code execution on the Langflow host, gaining access to secrets, internal network reachability, and the ability to persist or pivot further.

AML.T0050

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
153.9K Pushed 2d ago 20% patched ~70d to patch Full package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

0.7%

chance of exploitation in 30 days

Higher than 49% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I High

A High

What should I do?

1 step

Patch: upgrade Langflow OSS to a version beyond 1.10.1 as soon as a fixed release closing the denylist gap for OpenDsStarAgent, CodeActAgentSmolagents, and CSVAgent is available — check the IBM support advisory for the fix version. Workaround: disable or firewall the /api/v1/build_public_tmp/{flow_id}/flow endpoint if public flow building isn't required; if it is required, front it with a WAF rule blocking flow payloads referencing the named agent components. Detection: monitor Langflow server processes for unexpected child-process spawning, outbound connections, or file writes correlated with requests to the build_public_tmp endpoint, and review access logs for unauthenticated POSTs to that path. Defense-in-depth: run Langflow in a sandboxed, least-privilege container with no access to production credentials, since denylist-based code-execution filtering is inherently prone to bypass.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Auth Bypass Agent Framework Plugin AML.T0049 - Exploit Public-Facing Application AML.T0050 - Command and Scripting Interpreter AML.T0053 - AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6 - Verification and validation of AI system

NIST AI RMF

MEASURE 2.7 - AI system security and resilience are evaluated and documented

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-13448?

IBM's Langflow OSS ships a public flow-build endpoint designed to run without authentication, and an incomplete denylist in its code-execution filter fails to block several agent components — including CodeActAgentSmolagents and CSVAgent — that can run arbitrary code on the server. Any CISO running Langflow to orchestrate AI agents should treat this as a direct path to full server compromise: the CVSS 8.1 score reflects complete loss of confidentiality, integrity, and availability, and no privileges or user interaction are required, only network access to the build endpoint. There's no EPSS score, public exploit, or Nuclei template yet and it isn't in CISA KEV, but Langflow has a track record of being actively exploited within days of disclosure, so treat the absence of telemetry as a lagging indicator, not reassurance. Attack complexity is rated high because the attacker must know the specific denylist gaps, but that knowledge is now public via this advisory. Patch to a Langflow release beyond 1.10.1 once available, and in the meantime restrict or firewall /api/v1/build_public_tmp/{flow_id}/flow and disable public flow builds if the feature isn't actively used.

Is CVE-2026-13448 actively exploited?

No confirmed active exploitation of CVE-2026-13448 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-13448?

Patch: upgrade Langflow OSS to a version beyond 1.10.1 as soon as a fixed release closing the denylist gap for OpenDsStarAgent, CodeActAgentSmolagents, and CSVAgent is available — check the IBM support advisory for the fix version. Workaround: disable or firewall the /api/v1/build_public_tmp/{flow_id}/flow endpoint if public flow building isn't required; if it is required, front it with a WAF rule blocking flow payloads referencing the named agent components. Detection: monitor Langflow server processes for unexpected child-process spawning, outbound connections, or file writes correlated with requests to the build_public_tmp endpoint, and review access logs for unauthenticated POSTs to that path. Defense-in-depth: run Langflow in a sandboxed, least-privilege container with no access to production credentials, since denylist-based code-execution filtering is inherently prone to bypass.

What systems are affected by CVE-2026-13448?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, no-code/low-code AI builders, public-facing AI orchestration endpoints.

What is the CVSS score for CVE-2026-13448?

CVE-2026-13448 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 0.67%.

What is the AI security impact?

Affected AI Architectures

agent frameworksno-code/low-code AI builderspublic-facing AI orchestration endpoints

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0050 Command and Scripting Interpreter

AML.T0053 AI Agent Tool Invocation

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.10.1 Lanflow OSS contains an unauthenticated remote code execution vulnerability in the public flow build endpoint ( /api/v1/build_public_tmp/{flow_id}/flow ). The vulnerability stems from an incomplete denylist in the validate_public_flow_no_code_execution() function that fails to block several code-execution agent components including OpenDsStarAgent, CodeActAgentSmolagents, and CSVAgent.

Exploitation Scenario

An unauthenticated attacker discovers an internet-facing Langflow instance and identifies a publicly buildable flow ID (often predictable or leaked via shared links). They submit a flow definition to /api/v1/build_public_tmp/{flow_id}/flow that includes a CSVAgent or CodeActAgentSmolagents component configured to execute attacker-supplied code — components the validate_public_flow_no_code_execution() denylist doesn't recognize as code-execution-capable. Langflow builds and runs the flow server-side without requiring login, executing the attacker's code in the context of the Langflow process. From there the attacker has a foothold on the host: they can read environment variables and secrets, pivot to any internal services the Langflow server can reach, or establish persistence — all without ever authenticating.