CVE-2026-17624: Langflow authenticated RCE

CISO Take

IBM's Langflow, the widely used low-code framework for building LLM agents and workflows, fails to properly validate module imports, letting any authenticated user with even low privileges execute arbitrary code on the server (CVSS 8.8, no user interaction required). This matters because Langflow instances typically run with broad filesystem, credential, and network access to power agent pipelines, so a single compromised low-privilege account becomes full host takeover, exposing API keys, connected vector stores, and any downstream systems the agent orchestrates. The mitigating factors are real: EPSS sits at just 0.38% (top 69th percentile, not the tail), there's no CISA KEV listing, no public exploit or Nuclei template, and CISA's SSVC decision is TRACK rather than Act — this is not yet being weaponized in the wild. Given IBM stewards Langflow OSS and the CWE-94 code-injection root cause, treat this as a routine but non-negotiable patch: upgrade past 1.10.3 immediately, audit who holds Langflow accounts, and tighten module/import allowlists as a compensating control until patched. Detection teams should watch Langflow server logs for anomalous Python import paths or unexpected outbound connections from the Langflow process.

Sources: NVD EPSS ATLAS ibm.com

What is the risk?

High severity (CVSS 8.8) but currently low exploitation likelihood: EPSS is under 0.4% and CISA SSVC rates it TRACK, with no KEV listing, public exploit, or scanner template available. The requirement for authenticated access (PR:L) narrows the attack surface to insiders, compromised low-privilege accounts, or environments where Langflow exposes self-signup/shared tenancy — a common pattern in internal AI tooling deployments. Impact if exploited is severe (full C/I/A compromise), so the risk profile is 'low probability, high consequence' rather than an imminent threat requiring emergency response.

How does the attack unfold?

Initial Access

Attacker obtains or already holds a low-privilege authenticated account on a Langflow instance.

AML.T0012

Exploitation

Attacker crafts a flow/component that supplies an unvalidated module import path, triggering the CWE-94 code injection flaw.

AML.T0049

Code Execution

Langflow server imports and executes the attacker-controlled module, yielding arbitrary command execution on the host.

AML.T0050

Impact

Attacker leverages the compromised Langflow service account to steal connected API keys/credentials and pivot into downstream AI infrastructure.

AML.T0025

Initial Access

Attacker obtains or already holds a low-privilege authenticated account on a Langflow instance.

AML.T0012

Exploitation

Attacker crafts a flow/component that supplies an unvalidated module import path, triggering the CWE-94 code injection flaw.

AML.T0049

Code Execution

Langflow server imports and executes the attacker-controlled module, yielding arbitrary command execution on the host.

AML.T0050

Impact

Attacker leverages the compromised Langflow service account to steal connected API keys/credentials and pivot into downstream AI infrastructure.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
155.0K Pushed 2d ago 17% patched ~70d to patch Full package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 32% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I High

A High

What should I do?

1 step

Upgrade Langflow OSS to a version beyond 1.10.3 as soon as IBM's fix is available (track https://www.ibm.com/support/pages/node/7282646 for the patched release). Until patched, restrict who can create/edit flows to trusted, need-to-know users only, and avoid shared or self-service account provisioning on Langflow instances. Where feasible, run Langflow in a sandboxed/containerized environment with minimal filesystem and network egress permissions, and restrict outbound access from the Langflow host to only required LLM/vector-store endpoints. Monitor Langflow application logs and host-level EDR for unexpected Python module imports, unusual subprocess spawns, or outbound connections originating from the Langflow process, and review authenticated account activity for flow edits by low-privilege users.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Framework Agent AML.T0011.001 - Malicious Package AML.T0049 - Exploit Public-Facing Application AML.T0050 - Command and Scripting Interpreter

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

NIST AI RMF

MEASURE 2.7 - AI system security and resilience are evaluated and documented

OWASP LLM Top 10

LLM03 - Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2026-17624?

IBM's Langflow, the widely used low-code framework for building LLM agents and workflows, fails to properly validate module imports, letting any authenticated user with even low privileges execute arbitrary code on the server (CVSS 8.8, no user interaction required). This matters because Langflow instances typically run with broad filesystem, credential, and network access to power agent pipelines, so a single compromised low-privilege account becomes full host takeover, exposing API keys, connected vector stores, and any downstream systems the agent orchestrates. The mitigating factors are real: EPSS sits at just 0.38% (top 69th percentile, not the tail), there's no CISA KEV listing, no public exploit or Nuclei template, and CISA's SSVC decision is TRACK rather than Act — this is not yet being weaponized in the wild. Given IBM stewards Langflow OSS and the CWE-94 code-injection root cause, treat this as a routine but non-negotiable patch: upgrade past 1.10.3 immediately, audit who holds Langflow accounts, and tighten module/import allowlists as a compensating control until patched. Detection teams should watch Langflow server logs for anomalous Python import paths or unexpected outbound connections from the Langflow process.

Is CVE-2026-17624 actively exploited?

No confirmed active exploitation of CVE-2026-17624 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-17624?

Upgrade Langflow OSS to a version beyond 1.10.3 as soon as IBM's fix is available (track https://www.ibm.com/support/pages/node/7282646 for the patched release). Until patched, restrict who can create/edit flows to trusted, need-to-know users only, and avoid shared or self-service account provisioning on Langflow instances. Where feasible, run Langflow in a sandboxed/containerized environment with minimal filesystem and network egress permissions, and restrict outbound access from the Langflow host to only required LLM/vector-store endpoints. Monitor Langflow application logs and host-level EDR for unexpected Python module imports, unusual subprocess spawns, or outbound connections originating from the Langflow process, and review authenticated account activity for flow edits by low-privilege users.

What systems are affected by CVE-2026-17624?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, LLM orchestration pipelines, RAG pipelines.

What is the CVSS score for CVE-2026-17624?

CVE-2026-17624 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.38%.

What is the AI security impact?

Affected AI Architectures

agent frameworksLLM orchestration pipelinesRAG pipelines

MITRE ATLAS Techniques

AML.T0011.001 Malicious Package

AML.T0049 Exploit Public-Facing Application

AML.T0050 Command and Scripting Interpreter

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of module imports.

Exploitation Scenario

An attacker who has obtained (or been granted) a low-privilege Langflow account — via a compromised credential, an over-permissive multi-tenant setup, or an insider — creates or edits a flow and inserts a component that references an attacker-controlled module path. Because Langflow does not properly validate the imported module, the server loads and executes it when the flow runs, giving the attacker a foothold with the privileges of the Langflow service account. From there they can read environment variables and API keys used by connected LLM providers and vector databases, pivot to other services reachable from the host, or tamper with the outputs of AI agents relying on that Langflow instance, all without needing admin rights or user interaction from a victim.

Weaknesses (CWE)

CWE-94 Improper Control of Generation of Code ('Code Injection') Primary CWE-94 Improper Control of Generation of Code ('Code Injection')

CWE-94 — Improper Control of Generation of Code ('Code Injection'): The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

[Architecture and Design] Refactor your program so that you do not have to dynamically generate code.
[Architecture and Design] Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.