CVE-2026-19286: Langflow unauthenticated RCE

CISO Take

IBM Langflow OSS versions 1.0.0 through 1.11.1 fail to properly enforce security restrictions on the A2A (agent-to-agent) public endpoint, letting a remote, unauthenticated attacker execute arbitrary code on the host. This is a network-exploitable, zero-interaction flaw with maximum-severity impact (CVSS 9.8, C:H/I:H/A:H), and Langflow is a widely deployed low-code framework for building LLM agent workflows, so a compromised instance can expose connected LLM API keys, vector store credentials, RAG data sources, and any downstream systems the agent workflows reach. There is no EPSS score or CISA KEV listing yet and no public exploit or Nuclei template has surfaced, but Langflow has a documented history of publicly exploited RCEs in prior CVEs, so the lack of current telemetry should not be read as low risk since exploitation data typically lags fresh disclosures by days. Patch to a release beyond 1.11.1 per IBM's advisory now; until patched, remove the A2A endpoint from public/internet exposure and audit access logs for anomalous requests to A2A-related routes. Security teams should also inventory all internet-facing Langflow instances immediately, since agent-framework RCEs of this type have historically been mass-scanned within days of disclosure.

Sources:NVDIBM SupportATLAS

What is the risk?

Critical. The vulnerability combines network attack vector, low attack complexity, no privileges required, and no user interaction (AV:N/AC:L/PR:N/UI:N) with full compromise of confidentiality, integrity, and availability (C:H/I:H/A:H) — the maximum-severity combination short of a wormable flaw. While EPSS data and CISA KEV status are not yet available and no public exploit or scanner template has been observed, the low complexity and lack of any authentication barrier mean weaponization is likely trivial once a proof-of-concept surfaces. Langflow's history of previously exploited RCEs in the same product family raises the probability that this CVE follows the same pattern of rapid, opportunistic scanning against exposed instances.

How does the attack unfold?

Reconnaissance

Attacker scans for internet-exposed Langflow instances and identifies the public A2A endpoint.

AML.T0006

Exploitation

Attacker sends a crafted request exploiting improper enforcement of security restrictions on the A2A endpoint to trigger code injection.

AML.T0049

Execution

Arbitrary code executes on the Langflow host, giving the attacker a foothold with the privileges of the Langflow process.

AML.T0050

Impact

Attacker harvests LLM API keys, vector DB credentials, and RAG data, and pivots into connected systems reachable from the compromised host.

AML.T0112

Reconnaissance

Attacker scans for internet-exposed Langflow instances and identifies the public A2A endpoint.

AML.T0006

Exploitation

Attacker sends a crafted request exploiting improper enforcement of security restrictions on the A2A endpoint to trigger code injection.

AML.T0049

Execution

Arbitrary code executes on the Langflow host, giving the attacker a foothold with the privileges of the Langflow process.

AML.T0050

Impact

Attacker harvests LLM API keys, vector DB credentials, and RAG data, and pivots into connected systems reachable from the compromised host.

AML.T0112

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
156.0KPushed 6d ago18% patched~66d to patchFull package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

0.9%

chance of exploitation in 30 days

Higher than 59% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Patch Langflow to a version released after 1.11.1 per IBM's advisory (https://www.ibm.com/support/pages/node/7284733) as the primary remediation. 2) Until patched, do not expose the A2A endpoint (or the Langflow instance generally) directly to the internet — place it behind a VPN, reverse proxy with authentication, or restrict via network ACLs/firewall rules to trusted IPs only. 3) Audit existing deployments for internet exposure using asset inventory/attack-surface tooling; treat any publicly reachable Langflow instance as high-priority. 4) Review access and application logs for anomalous or unauthenticated requests to A2A-related routes, unexpected process spawning, or outbound connections from the Langflow host. 5) Rotate any credentials (LLM API keys, vector DB tokens, connected service secrets) accessible to a potentially compromised Langflow instance as a precaution.

What does CISA's SSVC say?

DecisionTrack*

Exploitationnone

AutomatableYes

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth BypassCode ExecutionFrameworkAgentAML.T0049- Exploit Public-Facing Application AML.T0050- Command and Scripting Interpreter AML.T0112- Machine Compromise

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system deployment

NIST AI RMF

MEASURE 2.7-AI system security and resilience are evaluated and documented

OWASP LLM Top 10

LLM05-Improper Output Handling

Frequently Asked Questions

What is CVE-2026-19286?

IBM Langflow OSS versions 1.0.0 through 1.11.1 fail to properly enforce security restrictions on the A2A (agent-to-agent) public endpoint, letting a remote, unauthenticated attacker execute arbitrary code on the host. This is a network-exploitable, zero-interaction flaw with maximum-severity impact (CVSS 9.8, C:H/I:H/A:H), and Langflow is a widely deployed low-code framework for building LLM agent workflows, so a compromised instance can expose connected LLM API keys, vector store credentials, RAG data sources, and any downstream systems the agent workflows reach. There is no EPSS score or CISA KEV listing yet and no public exploit or Nuclei template has surfaced, but Langflow has a documented history of publicly exploited RCEs in prior CVEs, so the lack of current telemetry should not be read as low risk since exploitation data typically lags fresh disclosures by days. Patch to a release beyond 1.11.1 per IBM's advisory now; until patched, remove the A2A endpoint from public/internet exposure and audit access logs for anomalous requests to A2A-related routes. Security teams should also inventory all internet-facing Langflow instances immediately, since agent-framework RCEs of this type have historically been mass-scanned within days of disclosure.

Is CVE-2026-19286 actively exploited?

No confirmed active exploitation of CVE-2026-19286 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-19286?

1) Patch Langflow to a version released after 1.11.1 per IBM's advisory (https://www.ibm.com/support/pages/node/7284733) as the primary remediation. 2) Until patched, do not expose the A2A endpoint (or the Langflow instance generally) directly to the internet — place it behind a VPN, reverse proxy with authentication, or restrict via network ACLs/firewall rules to trusted IPs only. 3) Audit existing deployments for internet exposure using asset inventory/attack-surface tooling; treat any publicly reachable Langflow instance as high-priority. 4) Review access and application logs for anomalous or unauthenticated requests to A2A-related routes, unexpected process spawning, or outbound connections from the Langflow host. 5) Rotate any credentials (LLM API keys, vector DB tokens, connected service secrets) accessible to a potentially compromised Langflow instance as a precaution.

What systems are affected by CVE-2026-19286?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines, model serving, multi-agent orchestration.

What is the CVSS score for CVE-2026-19286?

CVE-2026-19286 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 0.86%.

What is the AI security impact?

Affected AI Architectures

agent frameworksRAG pipelinesmodel servingmulti-agent orchestration

MITRE ATLAS Techniques

AML.T0049Exploit Public-Facing Application

AML.T0050Command and Scripting Interpreter

AML.T0112Machine Compromise

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM05

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary code due to improper enforcement of security restrictions on the A2A public endpoint.

Exploitation Scenario

An attacker scans the internet for exposed Langflow instances (a common low-code AI agent platform) and identifies the A2A public endpoint, which is intended to allow agents to communicate with one another but does not correctly enforce access restrictions. The attacker crafts a request that abuses this improperly restricted endpoint to trigger code injection (CWE-94) on the underlying server, gaining a foothold with the privileges of the Langflow process. From there, the attacker harvests LLM API keys and vector database credentials stored in the Langflow environment, exfiltrates proprietary agent configurations and RAG data sources, and potentially pivots into other internal systems the compromised host can reach — all without needing any valid credentials or user interaction.

Weaknesses (CWE)

CWE-94Improper Control of Generation of Code ('Code Injection')Primary CWE-94Improper Control of Generation of Code ('Code Injection')

CWE-94 — Improper Control of Generation of Code ('Code Injection'): The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

[Architecture and Design] Refactor your program so that you do not have to dynamically generate code.
[Architecture and Design] Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.