CVE-2026-14499: Langflow command execution

CISO Take

This vulnerability lets an authenticated but low-privileged Langflow user break out of the platform's Python Interpreter component and run arbitrary OS commands with elevated privileges, turning a legitimate no-code AI workflow feature into a full remote-code-execution primitive. Langflow is a widely deployed open-source framework for building LLM and agentic pipelines, so any self-hosted instance that exposes the Python Interpreter node to non-admin users — common in multi-tenant or team setups with self-service signup — is exposed to host compromise, credential theft, and lateral movement into connected LLM provider keys and downstream systems. There is no confirmed public exploit, no Nuclei template, and it is not in CISA KEV, but the CVSS 8.8 score combined with network attack vector, low complexity, and no user interaction means weaponization is straightforward once an attacker holds any authenticated foothold. Upgrade Langflow past 1.10.1 immediately; until patched, restrict the Python Interpreter component to admin-only roles, do not expose Langflow instances directly to the internet, and audit component execution logs for unexpected subprocess or shell activity.

Sources: NVD CISA KEV ATLAS ibm.com

What is the risk?

High risk. CVSS 8.8 with AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H means a low-privileged authenticated attacker can trigger the flaw over the network with no user interaction and achieve full compromise of confidentiality, integrity, and availability. The barrier to exploitation is simply obtaining a low-privilege account (self-signup, shared credentials, or a leaked API key), which is common in team/multi-tenant Langflow deployments. No EPSS score, KEV listing, public exploit, or Nuclei template exists yet, so active mass-exploitation is not currently observed — but the vulnerability class (OS command injection, CWE-78) is trivial to weaponize once access is obtained, and Langflow's popularity as an agent-building framework makes it an attractive target.

How does the attack unfold?

Initial Access

Attacker obtains a low-privileged authenticated Langflow account via self-signup or a leaked credential.

AML.T0012

Exploitation

Attacker crafts malicious input to the Python Interpreter component, triggering unsanitized command injection.

AML.T0050

Privilege Escalation

The injected command executes with elevated privileges, giving the attacker OS-level control of the Langflow host.

Impact

Attacker exfiltrates LLM provider keys and other credentials, tampers with flows, and pivots into connected infrastructure.

AML.T0025

Initial Access

Attacker obtains a low-privileged authenticated Langflow account via self-signup or a leaked credential.

AML.T0012

Exploitation

Attacker crafts malicious input to the Python Interpreter component, triggering unsanitized command injection.

AML.T0050

Privilege Escalation

The injected command executes with elevated privileges, giving the attacker OS-level control of the Langflow host.

Impact

Attacker exfiltrates LLM provider keys and other credentials, tampers with flows, and pivots into connected infrastructure.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
155.0K Pushed 2d ago 17% patched ~70d to patch Full package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.7%

chance of exploitation in 30 days

Higher than 50% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I High

A High

What should I do?

1 step

Patch to a Langflow release beyond 1.10.1 as soon as it is available and verified against the vendor advisory. Until patched: restrict access to the Python Interpreter component to admin/trusted roles only via RBAC, disable self-service signup or gate it behind approval, and avoid exposing Langflow instances directly to the public internet — place them behind VPN or IP allowlisting. Monitor for anomalous subprocess/shell execution originating from the Langflow process, review audit logs for flows using the Python Interpreter component created by low-privilege users, and rotate any credentials (LLM API keys, DB secrets) accessible from the Langflow host as a precaution if exposure is suspected.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Framework Plugin AML.T0012 - Valid Accounts AML.T0049 - Exploit Public-Facing Application AML.T0050 - Command and Scripting Interpreter

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6 - AI system security

NIST AI RMF

MEASURE 2.7 - AI system security and resilience is evaluated and documented

OWASP LLM Top 10

LLM05 - Improper Output Handling

Frequently Asked Questions

What is CVE-2026-14499?

This vulnerability lets an authenticated but low-privileged Langflow user break out of the platform's Python Interpreter component and run arbitrary OS commands with elevated privileges, turning a legitimate no-code AI workflow feature into a full remote-code-execution primitive. Langflow is a widely deployed open-source framework for building LLM and agentic pipelines, so any self-hosted instance that exposes the Python Interpreter node to non-admin users — common in multi-tenant or team setups with self-service signup — is exposed to host compromise, credential theft, and lateral movement into connected LLM provider keys and downstream systems. There is no confirmed public exploit, no Nuclei template, and it is not in CISA KEV, but the CVSS 8.8 score combined with network attack vector, low complexity, and no user interaction means weaponization is straightforward once an attacker holds any authenticated foothold. Upgrade Langflow past 1.10.1 immediately; until patched, restrict the Python Interpreter component to admin-only roles, do not expose Langflow instances directly to the internet, and audit component execution logs for unexpected subprocess or shell activity.

Is CVE-2026-14499 actively exploited?

No confirmed active exploitation of CVE-2026-14499 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-14499?

Patch to a Langflow release beyond 1.10.1 as soon as it is available and verified against the vendor advisory. Until patched: restrict access to the Python Interpreter component to admin/trusted roles only via RBAC, disable self-service signup or gate it behind approval, and avoid exposing Langflow instances directly to the public internet — place them behind VPN or IP allowlisting. Monitor for anomalous subprocess/shell execution originating from the Langflow process, review audit logs for flows using the Python Interpreter component created by low-privilege users, and rotate any credentials (LLM API keys, DB secrets) accessible from the Langflow host as a precaution if exposure is suspected.

What systems are affected by CVE-2026-14499?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, LLM orchestration pipelines, RAG pipelines.

What is the CVSS score for CVE-2026-14499?

CVE-2026-14499 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.66%.

What is the AI security impact?

Affected AI Architectures

agent frameworksLLM orchestration pipelinesRAG pipelines

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0049 Exploit Public-Facing Application

AML.T0050 Command and Scripting Interpreter

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM05

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.10.1 Langflow could allow an authenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied input in the Python Interpreter component.

Exploitation Scenario

An attacker registers for or otherwise obtains a low-privileged authenticated Langflow account — for example through open self-signup or a leaked API key. They build or edit a flow that uses the Python Interpreter component, supplying crafted input that is not properly validated and gets passed into the underlying interpreter/shell context. This triggers OS command injection, letting the attacker execute arbitrary commands with elevated privileges on the host. From there they harvest LLM provider keys and other credentials stored in the environment, tamper with other users' pipelines, and use the compromised host as a foothold into the broader network.

Weaknesses (CWE)

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Primary CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-78 — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'): The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

[Architecture and Design] If at all possible, use library calls rather than external processes to recreate the desired functionality.
[Architecture and Design, Operation] Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software. OS-level examples include the Unix chroot jail, AppArmor, and SELinux. In general, managed code may provide some protection. For example, java.io.FilePermission in the Java SecurityManager allows the software to specify restrictions on file operations. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of the application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.