CVE-2026-18894: Langflow: public flow triggers stored Python code RCE

CRITICAL

Published October 29, 2026

CISO Take

IBM Langflow OSS 1.0.0 through 1.12.4 lets an unauthenticated remote attacker trigger Python component code already stored in a public workflow, and that code runs inside the server process with the flow owner's runtime context. This breaks the intended boundary that public execution paths only run server-trusted components. The CVSS score is a moderate 6.5 (C:L/I:L, no privileges or user interaction required). However, any internet-exposed Langflow instance with public flows is exposed, and server-process execution can reach the flow owner's API keys, model credentials and connected data stores. There is no KEV listing, public exploit, Nuclei template or EPSS score yet, so exploitation is unconfirmed, but the low attack complexity makes it likely to attract attention. Upgrade to the fixed release in IBM's advisory (above 1.12.4), and until then, disable public sharing of flows and audit which flows are public and what custom Python components they contain.

Sources:NVDibm.comATLAS

What is the risk?

Medium by CVSS (6.5), but real-world risk depends on exposure. Exploitation needs only network access to a public flow, with low complexity, no privileges and no user interaction. The attacker cannot supply arbitrary code; they trigger code already stored in the flow, which limits impact to what that code does and what the runtime context can reach. Code runs in the server process, so effective impact can be higher than the C:L/I:L score suggests if flows hold secrets or powerful tools. No KEV, public exploit, Nuclei template or EPSS data is available (confidence: MEDIUM, based on the NVD description and IBM advisory only).

How does the attack unfold?

Reconnaissance

Attacker finds an internet-exposed Langflow instance and identifies a public workflow containing stored Python components.

AML.T0006

Initial Access

Attacker sends an unauthenticated request to the public flow's execution endpoint, with no credentials or user interaction needed.

AML.T0049

Execution

The stored Python component runs inside the server process under the flow owner's runtime context, bypassing the server-trusted-only restriction.

AML.T0050

Impact

The component's actions expose or misuse owner-accessible secrets, data stores and LLM resources, with possible pivoting from the Langflow host.

AML.T0048

Reconnaissance

Attacker finds an internet-exposed Langflow instance and identifies a public workflow containing stored Python components.

AML.T0006

Initial Access

Attacker sends an unauthenticated request to the public flow's execution endpoint, with no credentials or user interaction needed.

AML.T0049

Execution

The stored Python component runs inside the server process under the flow owner's runtime context, bypassing the server-trusted-only restriction.

AML.T0050

Impact

The component's actions expose or misuse owner-accessible secrets, data stores and LLM resources, with possible pivoting from the Langflow host.

AML.T0048

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
156.0KPushed 6d ago18% patched~66d to patchFull package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 42% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CHigh

IHigh

AHigh

What should I do?

6 steps

Upgrade Langflow OSS to the fixed version listed in IBM's advisory (https://www.ibm.com/support/pages/node/7293016).
Until patched, disable or unpublish public flows and restrict the Langflow endpoint to trusted networks or behind an authenticating reverse proxy.
Inventory flows with custom Python components, especially public ones, and review the code for side effects, network calls and secret access.
Run Langflow with least-privilege credentials, a restricted network egress policy and scoped, rotatable API keys.
Detect by monitoring unauthenticated requests to public flow run endpoints, unexpected outbound connections from the Langflow process, and anomalous LLM or vector DB API usage.
Rotate secrets available to the flow owner if suspicious execution is found.

How is it classified?

Code ExecutionAuth BypassFrameworkAgentAML.T0049- Exploit Public-Facing Application AML.T0050- Command and Scripting Interpreter AML.T0053- AI Agent Tool Invocation

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Procedures to respond to and recover from unknown risks

OWASP LLM Top 10

LLM03-Supply ChainLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-18894?

Is CVE-2026-18894 actively exploited?

No confirmed active exploitation of CVE-2026-18894 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-18894?

1. Upgrade Langflow OSS to the fixed version listed in IBM's advisory (https://www.ibm.com/support/pages/node/7293016). 2. Until patched, disable or unpublish public flows and restrict the Langflow endpoint to trusted networks or behind an authenticating reverse proxy. 3. Inventory flows with custom Python components, especially public ones, and review the code for side effects, network calls and secret access. 4. Run Langflow with least-privilege credentials, a restricted network egress policy and scoped, rotatable API keys. 5. Detect by monitoring unauthenticated requests to public flow run endpoints, unexpected outbound connections from the Langflow process, and anomalous LLM or vector DB API usage. 6. Rotate secrets available to the flow owner if suspicious execution is found.

What systems are affected by CVE-2026-18894?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines, LLM workflow orchestration, low-code AI app builders.

What is the CVSS score for CVE-2026-18894?

CVE-2026-18894 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 0.49%.

What is the AI security impact?

Affected AI Architectures

agent frameworksRAG pipelinesLLM workflow orchestrationlow-code AI app builders

MITRE ATLAS Techniques

AML.T0049Exploit Public-Facing Application

AML.T0050Command and Scripting Interpreter

AML.T0053AI Agent Tool Invocation

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03, LLM06

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to trigger pre-existing stored Python component code in a public workflow, executing it under the flow owner's runtime context within the server process. This bypasses the intended trust boundary where public execution paths are restricted to server-trusted component code.

Exploitation Scenario

An organization publishes a Langflow workflow as a public chatbot, and the flow includes a custom Python component that calls internal services using the owner's API keys. An attacker discovers the exposed Langflow instance through internet scanning, identifies the public flow, and sends crafted requests to its public execution endpoint that cause the stored Python component to run in the server process. The component runs with the flow owner's context, letting the attacker trigger actions such as querying connected data stores, consuming paid LLM quota or leaking data through the component's outputs. Combined with a permissive component, this can become a foothold for lateral movement from the Langflow host.

Weaknesses (CWE)

CWE-94Improper Control of Generation of Code ('Code Injection')Primary CWE-94Improper Control of Generation of Code ('Code Injection')

CWE-94 — Improper Control of Generation of Code ('Code Injection'): The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

[Architecture and Design] Refactor your program so that you do not have to dynamically generate code.
[Architecture and Design] Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.