AI Threat AlertCVE-2026-18891: Langflow: broken auth allows unauthorized flow execution
HIGHCVE-2026-18891 is an improper authentication flaw (CWE-287) in IBM Langflow OSS 1.0.0 through 1.11.1 that lets an unauthenticated, remote attacker execute arbitrary flows and read sensitive information without any credentials or user interaction. Langflow is a widely used low-code framework for building LLM agents and RAG pipelines, and flows commonly embed API keys, database connection strings, and proprietary prompts or business logic — exactly the class of data this CVSS 8.2 vector (C:H/I:L/A:N) exposes. There is no CISA KEV listing, no public exploit or Nuclei template, and EPSS data isn't yet available, so evidence of in-the-wild exploitation is currently absent; however, Langflow has a documented history of unauthenticated RCE being mass-exploited shortly after disclosure (CVE-2025-3248), which raises the bar on how fast this bug class tends to get weaponized. Any Langflow instance reachable from the internet or a flat internal network should be treated as exposed today, not after a scanner signature appears. Patch to a version above 1.11.1 as soon as it's available, and in the interim place Langflow behind an authenticating reverse proxy or VPN and audit flows for embedded secrets that may already be exposed.
What is the risk?
High risk despite the 'high' (not critical) CVSS rating: the combination of network attack vector, low complexity, no privileges required, and no user interaction (AV:N/AC:L/PR:N/UI:N) means any attacker who can reach the Langflow API can trigger this without social engineering or prior access. Confidentiality impact is high — arbitrary flow execution can surface secrets, model API keys, and RAG-indexed proprietary data — while integrity impact is limited and there is no direct availability impact. Absence from CISA KEV and lack of a public PoC or Nuclei template lower near-term mass-exploitation risk today, but Langflow's prior unauthenticated-RCE CVE (CVE-2025-3248) was weaponized quickly post-disclosure, so this should not be deprioritized as theoretical.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| Langflow | pip | — | No patch |
Do you use Langflow? You're affected.
How severe is it?
What is the attack surface?
What should I do?
1 stepUpgrade Langflow OSS to a version beyond 1.11.1 once IBM/Langflow publishes a fix release (track the vendor advisory at ibm.com/support/pages/node/7284579). Until patched, do not expose the Langflow API or UI directly to the internet — place it behind a reverse proxy or VPN that enforces its own authentication, and restrict network access to known admin IPs via firewall/security-group rules. Rotate any API keys, database credentials, or tokens embedded in existing flow definitions, since they may already have been exposed if the instance was internet-reachable. For detection, review Langflow access logs for calls to flow-execution endpoints from unexpected source IPs or without valid session context, and monitor for anomalous outbound activity from the Langflow runtime such as unexpected LLM API usage or data egress.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-18891?
CVE-2026-18891 is an improper authentication flaw (CWE-287) in IBM Langflow OSS 1.0.0 through 1.11.1 that lets an unauthenticated, remote attacker execute arbitrary flows and read sensitive information without any credentials or user interaction. Langflow is a widely used low-code framework for building LLM agents and RAG pipelines, and flows commonly embed API keys, database connection strings, and proprietary prompts or business logic — exactly the class of data this CVSS 8.2 vector (C:H/I:L/A:N) exposes. There is no CISA KEV listing, no public exploit or Nuclei template, and EPSS data isn't yet available, so evidence of in-the-wild exploitation is currently absent; however, Langflow has a documented history of unauthenticated RCE being mass-exploited shortly after disclosure (CVE-2025-3248), which raises the bar on how fast this bug class tends to get weaponized. Any Langflow instance reachable from the internet or a flat internal network should be treated as exposed today, not after a scanner signature appears. Patch to a version above 1.11.1 as soon as it's available, and in the interim place Langflow behind an authenticating reverse proxy or VPN and audit flows for embedded secrets that may already be exposed.
Is CVE-2026-18891 actively exploited?
No confirmed active exploitation of CVE-2026-18891 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-18891?
Upgrade Langflow OSS to a version beyond 1.11.1 once IBM/Langflow publishes a fix release (track the vendor advisory at ibm.com/support/pages/node/7284579). Until patched, do not expose the Langflow API or UI directly to the internet — place it behind a reverse proxy or VPN that enforces its own authentication, and restrict network access to known admin IPs via firewall/security-group rules. Rotate any API keys, database credentials, or tokens embedded in existing flow definitions, since they may already have been exposed if the instance was internet-reachable. For detection, review Langflow access logs for calls to flow-execution endpoints from unexpected source IPs or without valid session context, and monitor for anomalous outbound activity from the Langflow runtime such as unexpected LLM API usage or data egress.
What systems are affected by CVE-2026-18891?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines, model serving, LLM orchestration.
What is the CVSS score for CVE-2026-18891?
CVE-2026-18891 has a CVSS v3.1 base score of 8.2 (HIGH). The EPSS exploitation probability is 0.54%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0025Exfiltration via Cyber MeansAML.T0049Exploit Public-Facing ApplicationAML.T0053AI Agent Tool InvocationAML.T0055Unsecured CredentialsCompliance Controls Affected
What are the technical details?
Original Advisory
IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary flows and access sensitive information due to improper authentication.
Exploitation Scenario
An attacker scans for internet-facing Langflow instances (common on default ports, often deployed by teams standing up internal AI agent PoCs without hardening). Finding one with the vulnerable authentication check, they call the flow-execution API directly, bypassing the UI's apparent login gate. They enumerate and run existing flows, some of which contain code-execution or tool-invocation nodes wired to the organization's LLM API keys, internal databases, or file systems. Through this arbitrary flow execution the attacker exfiltrates embedded credentials and any sensitive data surfaced by the flow's outputs — such as RAG-retrieved internal documents — potentially pivoting further using the harvested API keys or database access.
Weaknesses (CWE)
CWE-287 — Improper Authentication: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
- [Architecture and Design] Use an authentication framework or library such as the OWASP ESAPI Authentication feature.
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:NReferences
Timeline
Related Vulnerabilities
CVE-2026-1056110.0Langflow: auth bypass + unauthenticated RCE (CVSS 10)
Same package: langflowCVE-2026-1013410.0Langflow: unauthenticated RCE via tool_code injection
Same package: langflowCVE-2026-333099.9langflow: Path Traversal enables file access
Same package: langflowCVE-2026-552559.9Langflow: IDOR allows cross-user flow execution
Same package: langflowCVE-2026-78739.9Langflow: authenticated RCE enables credential theft
Same package: langflow