CVE-2026-17630: Langflow RCE — HIGH

CISO Take

IBM's Langflow, an open-source low-code framework widely used to build LLM agent workflows and pipelines, has a remote code execution flaw (CVSS 8.8) rooted in an incomplete validation of configuration parameters (CWE-184) — versions 1.0.0 through 1.10.3 are affected. An attacker with only low privileges and no user interaction can reach this over the network with low complexity, which is a meaningful blast radius given how many teams wire Langflow directly into agent pipelines with live LLM API keys and vector database credentials in its configuration. That said, this is not yet an active threat: it sits at the CISA SSVC "TRACK" tier, is not in CISA KEV, EPSS is low (0.42%, top 65% percentile), and there is no public exploit or Nuclei template as of this writing — so treat it as a patch-now, don't-panic issue rather than an emergency page. Upgrade Langflow to a version beyond 1.10.3 immediately, and in the interim ensure Langflow instances are not exposed to untrusted networks and that configuration-parameter inputs are constrained at the reverse proxy or WAF layer. Watch for anomalous process spawning or outbound connections from Langflow hosts as a detection signal while patching rolls out.

Sources: NVD EPSS CISA KEV IBM Support Advisory ATLAS

What is the risk?

The CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:H) score reflects a severe technical impact — full compromise of confidentiality, integrity, and availability with no user interaction required — but real-world exploitation likelihood is currently low. EPSS sits at 0.42% (top 65th percentile, not the upper tail), there's no evidence of a public exploit or scanner template, and CISA's SSVC decision is TRACK (the lowest-urgency tier, meaning no special action beyond routine patching). The requirement for low privileges (PR:L) also narrows the attack surface compared to a fully unauthenticated flaw. Net assessment: high potential severity, low current exploitation pressure — prioritize patching within normal cycles rather than as an emergency, but don't defer indefinitely given Langflow's role as an orchestration layer with access to sensitive downstream credentials.

How does the attack unfold?

Initial Access

An attacker with low-level privileges reaches a network-exposed Langflow instance and submits crafted configuration parameters.

AML.T0049

Exploitation

The incomplete denylist validation (CWE-184) fails to block the malicious parameter values, allowing them to trigger arbitrary code execution.

AML.T0050

Post-Exploitation

With code execution on the host, the attacker harvests LLM API keys and vector database credentials stored in the Langflow configuration.

AML.T0083

Impact

The attacker achieves full compromise of confidentiality, integrity, and availability of the Langflow environment and any downstream AI services it connects to.

Initial Access

An attacker with low-level privileges reaches a network-exposed Langflow instance and submits crafted configuration parameters.

AML.T0049

Exploitation

The incomplete denylist validation (CWE-184) fails to block the malicious parameter values, allowing them to trigger arbitrary code execution.

AML.T0050

Post-Exploitation

With code execution on the host, the attacker harvests LLM API keys and vector database credentials stored in the Langflow configuration.

AML.T0083

Impact

The attacker achieves full compromise of confidentiality, integrity, and availability of the Langflow environment and any downstream AI services it connects to.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
155.0K Pushed 2d ago 17% patched ~70d to patch Full package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 36% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I High

A High

What should I do?

1 step

1) Upgrade Langflow to a version newer than 1.10.3 per IBM's advisory as the primary fix. 2) Until patched, restrict network access to Langflow instances — place them behind authentication and network segmentation rather than exposing configuration endpoints directly to the internet or shared networks. 3) Apply input validation/allow-listing at a WAF or reverse-proxy layer in front of Langflow as a compensating control, since the underlying flaw is an incomplete denylist on configuration parameters. 4) Rotate any LLM API keys, vector DB credentials, or other secrets stored in Langflow configurations as a precaution if the instance was internet-facing prior to patching. 5) Monitor Langflow host logs for unexpected process execution, outbound network connections, or configuration changes as detection signals; there is no public exploit or Nuclei template yet, so no automated scanner-based detection is currently available.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Framework Agent AML.T0049 - Exploit Public-Facing Application AML.T0050 - Command and Scripting Interpreter AML.T0083 - Credentials from AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, Robustness and Cybersecurity

ISO 42001

A.6.2 - Security of the AI system

NIST AI RMF

MANAGE-4.1 - Risk treatment for deployed AI systems and third-party components

Frequently Asked Questions

What is CVE-2026-17630?

IBM's Langflow, an open-source low-code framework widely used to build LLM agent workflows and pipelines, has a remote code execution flaw (CVSS 8.8) rooted in an incomplete validation of configuration parameters (CWE-184) — versions 1.0.0 through 1.10.3 are affected. An attacker with only low privileges and no user interaction can reach this over the network with low complexity, which is a meaningful blast radius given how many teams wire Langflow directly into agent pipelines with live LLM API keys and vector database credentials in its configuration. That said, this is not yet an active threat: it sits at the CISA SSVC "TRACK" tier, is not in CISA KEV, EPSS is low (0.42%, top 65% percentile), and there is no public exploit or Nuclei template as of this writing — so treat it as a patch-now, don't-panic issue rather than an emergency page. Upgrade Langflow to a version beyond 1.10.3 immediately, and in the interim ensure Langflow instances are not exposed to untrusted networks and that configuration-parameter inputs are constrained at the reverse proxy or WAF layer. Watch for anomalous process spawning or outbound connections from Langflow hosts as a detection signal while patching rolls out.

Is CVE-2026-17630 actively exploited?

No confirmed active exploitation of CVE-2026-17630 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-17630?

1) Upgrade Langflow to a version newer than 1.10.3 per IBM's advisory as the primary fix. 2) Until patched, restrict network access to Langflow instances — place them behind authentication and network segmentation rather than exposing configuration endpoints directly to the internet or shared networks. 3) Apply input validation/allow-listing at a WAF or reverse-proxy layer in front of Langflow as a compensating control, since the underlying flaw is an incomplete denylist on configuration parameters. 4) Rotate any LLM API keys, vector DB credentials, or other secrets stored in Langflow configurations as a precaution if the instance was internet-facing prior to patching. 5) Monitor Langflow host logs for unexpected process execution, outbound network connections, or configuration changes as detection signals; there is no public exploit or Nuclei template yet, so no automated scanner-based detection is currently available.

What systems are affected by CVE-2026-17630?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, LLM orchestration pipelines, low-code AI workflow builders.

What is the CVSS score for CVE-2026-17630?

CVE-2026-17630 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.42%.

What is the AI security impact?

Affected AI Architectures

agent frameworksLLM orchestration pipelineslow-code AI workflow builders

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0050 Command and Scripting Interpreter

AML.T0083 Credentials from AI Agent Configuration

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2

NIST AI RMF: MANAGE-4.1

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote attacker to execute arbitrary code due to improper validation of configuration parameters.

Exploitation Scenario

An attacker who has obtained low-level access to a Langflow instance — for example, via a leaked API token, a misconfigured shared internal deployment, or a compromised low-privilege user account — submits crafted configuration parameters to the Langflow application. Because the input validation logic uses an incomplete disallow list (CWE-184) rather than a proper allow list, the malicious parameter values bypass the intended filtering and are processed in a way that triggers arbitrary code execution on the host. From there, the attacker has full run of the Langflow environment: they can read out LLM provider API keys and vector database credentials stored in flow configurations, tamper with or redirect agent workflows to exfiltrate data via connected tools, or pivot laterally into whatever infrastructure the Langflow instance's stored credentials grant access to.

Weaknesses (CWE)

CWE-184 Incomplete List of Disallowed Inputs Primary CWE-184 Incomplete List of Disallowed Inputs

CWE-184 — Incomplete List of Disallowed Inputs: The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.

[Implementation] Do not rely exclusively on detecting disallowed inputs. There are too many variants to encode a character, especially when different environments are used, so there is a high likelihood of missing some variants. Only use detection of disallowed inputs as a mechanism for detecting suspicious activity. Ensure that you are using other protection mechanisms that only identify "good" input - such as lists of allowed inputs - and ensure that you are properly encoding your outputs.

Source: MITRE CWE corpus.