CVE-2026-17625: Langflow RCE — HIGH

CISO Take

IBM Langflow, an open-source framework for building LLM agent workflows, contains an OS command injection flaw (CWE-78) that lets a remote authenticated attacker with high privileges execute arbitrary commands on the host, with full loss of confidentiality, integrity, and availability. It matters because Langflow instances typically run with broad filesystem and network access to orchestrate AI agents and tool calls, so command execution on the host can cascade into credential theft, pivoting to connected data sources, or full agent pipeline takeover. The urgency signal is muted for now: EPSS sits at 0.78% (top 47th percentile), it is not in CISA KEV, no public exploit or Nuclei template exists, and CISA's SSVC decision is TRACK rather than Act — but the requirement is only a valid account, not admin, and 112 other CVEs already exist in this package, indicating a history of exploitable weaknesses. Patch to a fixed version above 1.10.3 per IBM's advisory, and in the interim restrict Langflow access to trusted authenticated users only and monitor for anomalous child-process spawning from the Langflow service account.

Sources: NVD EPSS ibm.com ATLAS

What is the risk?

High CVSS (7.2) reflects severe impact (full C/I/A) with network access and no user interaction, but the requirement for high-privilege authentication meaningfully narrows the exploitable population versus an unauthenticated flaw. Combined with low EPSS (0.78%), no KEV listing, no public exploit code, and an SSVC TRACK verdict, near-term mass exploitation is unlikely. Risk rises sharply for any organization exposing Langflow with weak account segregation, shared/over-privileged service accounts, or internet-facing instances where credential compromise (phishing, reused passwords) is plausible — turning this into a straightforward path to RCE.

How does the attack unfold?

Authenticated Access

Attacker obtains valid high-privilege Langflow credentials through phishing, credential reuse, or insider access.

AML.T0012

Payload Injection

Attacker crafts a malicious value in a flow/component parameter that is passed unsanitized into an OS command.

AML.T0050

Command Execution

Langflow's backend executes the injected command with the privileges of the service process, giving the attacker code execution on the host.

AML.T0050

Impact

Attacker leverages host access to exfiltrate secrets, pivot to connected AI pipeline components, or persist for further compromise.

AML.T0112

Authenticated Access

Attacker obtains valid high-privilege Langflow credentials through phishing, credential reuse, or insider access.

AML.T0012

Payload Injection

Attacker crafts a malicious value in a flow/component parameter that is passed unsanitized into an OS command.

AML.T0050

Command Execution

Langflow's backend executes the injected command with the privileges of the service process, giving the attacker code execution on the host.

AML.T0050

Impact

Attacker leverages host access to exfiltrate secrets, pivot to connected AI pipeline components, or persist for further compromise.

AML.T0112

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
155.0K Pushed yesterday 17% patched ~70d to patch Full package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

7.2 / 10

EPSS

0.8%

chance of exploitation in 30 days

Higher than 54% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR High

UI None

S Unchanged

C High

I High

A High

What should I do?

1 step

1) Patch/upgrade Langflow OSS beyond 1.10.3 per IBM's advisory (https://www.ibm.com/support/pages/node/7282147) as soon as a fixed release is available. 2) Until patched, enforce least-privilege on Langflow accounts — eliminate unnecessary high-privilege users and rotate credentials for any account with elevated access. 3) Restrict network exposure of Langflow admin/flow-editing endpoints to trusted networks or VPN; do not expose management interfaces directly to the internet. 4) Run the Langflow service under a low-privilege, sandboxed OS account (container with dropped capabilities, no unnecessary filesystem/network access) to limit blast radius if exploited. 5) Enable process/command execution monitoring (EDR or auditd) on hosts running Langflow to detect anomalous shell spawns from the Langflow process tree. 6) Review Langflow flow/component configurations for any user-supplied fields that pass into system commands.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Framework Agent AML.T0012 - Valid Accounts AML.T0050 - Command and Scripting Interpreter

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

Annex A.6 (AI system security) - Security of AI systems

NIST AI RMF

MEASURE 2.7 - AI system security and resilience is evaluated

OWASP LLM Top 10

LLM05 - Improper Output Handling

Frequently Asked Questions

What is CVE-2026-17625?

IBM Langflow, an open-source framework for building LLM agent workflows, contains an OS command injection flaw (CWE-78) that lets a remote authenticated attacker with high privileges execute arbitrary commands on the host, with full loss of confidentiality, integrity, and availability. It matters because Langflow instances typically run with broad filesystem and network access to orchestrate AI agents and tool calls, so command execution on the host can cascade into credential theft, pivoting to connected data sources, or full agent pipeline takeover. The urgency signal is muted for now: EPSS sits at 0.78% (top 47th percentile), it is not in CISA KEV, no public exploit or Nuclei template exists, and CISA's SSVC decision is TRACK rather than Act — but the requirement is only a valid account, not admin, and 112 other CVEs already exist in this package, indicating a history of exploitable weaknesses. Patch to a fixed version above 1.10.3 per IBM's advisory, and in the interim restrict Langflow access to trusted authenticated users only and monitor for anomalous child-process spawning from the Langflow service account.

Is CVE-2026-17625 actively exploited?

No confirmed active exploitation of CVE-2026-17625 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-17625?

1) Patch/upgrade Langflow OSS beyond 1.10.3 per IBM's advisory (https://www.ibm.com/support/pages/node/7282147) as soon as a fixed release is available. 2) Until patched, enforce least-privilege on Langflow accounts — eliminate unnecessary high-privilege users and rotate credentials for any account with elevated access. 3) Restrict network exposure of Langflow admin/flow-editing endpoints to trusted networks or VPN; do not expose management interfaces directly to the internet. 4) Run the Langflow service under a low-privilege, sandboxed OS account (container with dropped capabilities, no unnecessary filesystem/network access) to limit blast radius if exploited. 5) Enable process/command execution monitoring (EDR or auditd) on hosts running Langflow to detect anomalous shell spawns from the Langflow process tree. 6) Review Langflow flow/component configurations for any user-supplied fields that pass into system commands.

What systems are affected by CVE-2026-17625?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, LLM orchestration / flow-builder platforms, RAG pipelines (where Langflow orchestrates retrieval components).

What is the CVSS score for CVE-2026-17625?

CVE-2026-17625 has a CVSS v3.1 base score of 7.2 (HIGH). The EPSS exploitation probability is 0.78%.

What is the AI security impact?

Affected AI Architectures

agent frameworksLLM orchestration / flow-builder platformsRAG pipelines (where Langflow orchestrates retrieval components)

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0050 Command and Scripting Interpreter

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: Annex A.6 (AI system security)

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM05

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

Exploitation Scenario

An attacker first obtains valid high-privilege credentials for a Langflow instance — via phishing, credential stuffing against a reused password, or insider access. Using that authenticated session, they craft a malicious value in a flow component parameter (e.g., a field that is passed unsanitized into a shell command used by a custom component or integration) and save/execute the flow. Langflow's backend executes the crafted payload as an OS command with the privileges of the Langflow service process, giving the attacker a foothold on the host. From there, the attacker can read environment secrets (LLM API keys, database credentials), pivot to connected vector databases or internal services reachable from the host, or establish persistence for further lateral movement across the AI pipeline.

Weaknesses (CWE)

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-78 — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'): The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

[Architecture and Design] If at all possible, use library calls rather than external processes to recreate the desired functionality.
[Architecture and Design, Operation] Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software. OS-level examples include the Unix chroot jail, AppArmor, and SELinux. In general, managed code may provide some protection. For example, java.io.FilePermission in the Java SecurityManager allows the software to specify restrictions on file operations. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of the application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.