CVE-2026-17633: Langflow authenticated code injection

CISO Take

IBM Langflow, a widely used low-code framework for building LLM and agent workflows, contains a code injection flaw (CWE-94) that lets any authenticated user — even one with low privileges — execute arbitrary code on the server, carrying a CVSS score of 8.8 with full confidentiality, integrity, and availability impact. This matters because Langflow instances typically hold API keys for LLM providers, credentials for connected vector databases and data sources, and the orchestration logic for production agent pipelines, so a single compromised low-privilege account becomes a path to full host takeover and secrets exfiltration. There is no public exploit or Nuclei template yet, it is not in CISA KEV, and CISA's own SSVC decision is TRACK (not TRACK*/ATTEND), with EPSS at 0.4% — signals that this is not being actively exploited today, though the low attack complexity and network-reachable, no-user-interaction profile mean that could change quickly once a PoC surfaces. Patch to a version beyond 1.10.3 per IBM's advisory immediately, and in the meantime restrict Langflow access to trusted users only, isolate the deployment from secrets and internal networks, and monitor for anomalous custom-component or flow-code submissions.

Sources: NVD EPSS CISA KEV ATLAS ibm.com

What is the risk?

High severity (CVSS 8.8) but currently lower urgency on exploitation likelihood: EPSS sits at 0.4% (top 67th percentile, not top-tier), there is no CISA KEV listing, no public exploit code, and no scanner template, and CISA's SSVC decision is TRACK. The requirement for low-privilege authentication (PR:L) narrows the pool of attackers to insiders, compromised accounts, or anyone with self-service signup access, which meaningfully reduces the realistic attack surface compared to unauthenticated flaws. However, low attack complexity, no required user interaction, and full C/I/A impact mean that once any authenticated foothold is obtained — a common occurrence via credential stuffing, phishing, or overly permissive multi-tenant configurations — exploitation is straightforward and the blast radius is severe.

How does the attack unfold?

Initial Access

Attacker obtains a low-privilege authenticated account on the Langflow instance via leaked credentials, phishing, or permissive self-signup.

AML.T0012

Exploitation

Attacker submits a crafted flow or custom component that exploits the CWE-94 code injection weakness in Langflow.

AML.T0049

Code Execution

The injected code executes server-side with the Langflow process's privileges, granting remote code execution.

AML.T0050

Impact

Attacker exfiltrates connected API keys and data-source credentials or pivots to full host/network compromise.

AML.T0025

Initial Access

Attacker obtains a low-privilege authenticated account on the Langflow instance via leaked credentials, phishing, or permissive self-signup.

AML.T0012

Exploitation

Attacker submits a crafted flow or custom component that exploits the CWE-94 code injection weakness in Langflow.

AML.T0049

Code Execution

The injected code executes server-side with the Langflow process's privileges, granting remote code execution.

AML.T0050

Impact

Attacker exfiltrates connected API keys and data-source credentials or pivots to full host/network compromise.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
155.0K Pushed 2d ago 17% patched ~70d to patch Full package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 34% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I High

A High

What should I do?

1 step

1) Upgrade Langflow beyond version 1.10.3 per IBM's advisory as the primary fix. 2) Until patched, restrict authenticated access to a minimal, trusted user set and disable self-service account creation if enabled. 3) Run Langflow in an isolated, sandboxed environment (container with least-privilege filesystem/network access) so that code execution within the app cannot reach secrets stores, internal networks, or other production systems. 4) Rotate any API keys or credentials stored in or accessible to the Langflow instance if compromise is suspected. 5) Monitor application and host logs for anomalous custom-component code submissions, unexpected subprocess spawning, or outbound connections from the Langflow host. 6) Apply network segmentation/WAF rules to limit exposure of the Langflow web UI to trusted networks only.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Framework Agent AML.T0012 - Valid Accounts AML.T0049 - Exploit Public-Facing Application AML.T0050 - Command and Scripting Interpreter

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.4 - AI system security

NIST AI RMF

MANAGE 4.1 - Third-party AI resource risk management

OWASP LLM Top 10

LLM03 - Supply Chain

Frequently Asked Questions

What is CVE-2026-17633?

IBM Langflow, a widely used low-code framework for building LLM and agent workflows, contains a code injection flaw (CWE-94) that lets any authenticated user — even one with low privileges — execute arbitrary code on the server, carrying a CVSS score of 8.8 with full confidentiality, integrity, and availability impact. This matters because Langflow instances typically hold API keys for LLM providers, credentials for connected vector databases and data sources, and the orchestration logic for production agent pipelines, so a single compromised low-privilege account becomes a path to full host takeover and secrets exfiltration. There is no public exploit or Nuclei template yet, it is not in CISA KEV, and CISA's own SSVC decision is TRACK (not TRACK*/ATTEND), with EPSS at 0.4% — signals that this is not being actively exploited today, though the low attack complexity and network-reachable, no-user-interaction profile mean that could change quickly once a PoC surfaces. Patch to a version beyond 1.10.3 per IBM's advisory immediately, and in the meantime restrict Langflow access to trusted users only, isolate the deployment from secrets and internal networks, and monitor for anomalous custom-component or flow-code submissions.

Is CVE-2026-17633 actively exploited?

No confirmed active exploitation of CVE-2026-17633 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-17633?

1) Upgrade Langflow beyond version 1.10.3 per IBM's advisory as the primary fix. 2) Until patched, restrict authenticated access to a minimal, trusted user set and disable self-service account creation if enabled. 3) Run Langflow in an isolated, sandboxed environment (container with least-privilege filesystem/network access) so that code execution within the app cannot reach secrets stores, internal networks, or other production systems. 4) Rotate any API keys or credentials stored in or accessible to the Langflow instance if compromise is suspected. 5) Monitor application and host logs for anomalous custom-component code submissions, unexpected subprocess spawning, or outbound connections from the Langflow host. 6) Apply network segmentation/WAF rules to limit exposure of the Langflow web UI to trusted networks only.

What systems are affected by CVE-2026-17633?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, low-code AI orchestration, RAG pipelines, model serving.

What is the CVSS score for CVE-2026-17633?

CVE-2026-17633 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.40%.

What is the AI security impact?

Affected AI Architectures

agent frameworkslow-code AI orchestrationRAG pipelinesmodel serving

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0049 Exploit Public-Facing Application

AML.T0050 Command and Scripting Interpreter

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.4

NIST AI RMF: MANAGE 4.1

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to code injection.

Exploitation Scenario

An attacker obtains a low-privilege authenticated account on an internet-facing or internally-shared Langflow instance — via leaked credentials, a phishing campaign, or abuse of a permissive self-signup flow. Using that access, they craft a flow or custom component that embeds malicious code exploiting the CWE-94 injection point, which the server executes with the privileges of the Langflow process. From there, the attacker achieves remote code execution on the underlying host, allowing them to exfiltrate connected LLM API keys and vector database credentials, tamper with production agent flows, or pivot laterally into the broader network — turning a single compromised low-privilege account into a full AI pipeline compromise.

Weaknesses (CWE)

CWE-94 Improper Control of Generation of Code ('Code Injection') Primary CWE-94 Improper Control of Generation of Code ('Code Injection')

CWE-94 — Improper Control of Generation of Code ('Code Injection'): The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

[Architecture and Design] Refactor your program so that you do not have to dynamically generate code.
[Architecture and Design] Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.