CVE-2026-19298: Langflow auth bypass

CISO Take

IBM Langflow OSS versions 1.0.0 through 1.11.2 contain an authorization bypass in the flow build process that lets a remote, already-authenticated user with only low privileges execute arbitrary code on the server, rated CVSS 8.8 with no user interaction required. This matters because Langflow instances typically hold LLM provider API keys, database credentials, and connected data-source secrets inside flow configurations — a successful exploit hands an attacker a foothold to pivot into every downstream system the flow orchestrates, not just the Langflow container itself. There is no evidence of active exploitation (not in CISA KEV, no public PoC, no Nuclei template, EPSS unscored), which lowers immediate urgency but does not eliminate risk given how low the bar is: any low-privilege account, including a shared or weakly-provisioned one, is sufficient. Patch to a fixed release above 1.11.2 as soon as IBM publishes one, and in the interim restrict who can create or build flows, avoid shared low-privilege accounts, place the instance behind network-level access controls, and monitor authentication plus flow-build API logs for privilege anomalies.

Sources:NVDibm.comATLAS

What is the risk?

High severity (CVSS 8.8) with low attack complexity and no user interaction, but exploitation requires an existing authenticated account with at least low privileges, which meaningfully narrows the exposure compared to a fully unauthenticated RCE. No active exploitation signals exist today (absent from CISA KEV, no EPSS score, no public exploit code, no Nuclei template), so this is a high-priority patch item rather than an emergency incident-response trigger. Risk rises sharply for any Langflow deployment that allows self-service signup, shares low-privilege accounts, or exposes the flow builder to a broad internal user base, since the authorization bypass effectively erases the trust boundary between low-privilege users and full code execution.

How does the attack unfold?

Initial Access

Attacker obtains or already holds a low-privilege authenticated account on the target Langflow instance.

AML.T0012

Authorization Bypass

Attacker invokes the flow build endpoint and exploits the missing authorization check to act beyond their account's intended privileges.

AML.T0049

Code Execution

The flow build process executes arbitrary attacker-supplied code on the Langflow server.

AML.T0050

Impact

Attacker gains full compromise of the Langflow host, exposing embedded LLM API keys, connector credentials, and any systems those credentials reach.

Initial Access

Attacker obtains or already holds a low-privilege authenticated account on the target Langflow instance.

AML.T0012

Authorization Bypass

Attacker invokes the flow build endpoint and exploits the missing authorization check to act beyond their account's intended privileges.

AML.T0049

Code Execution

The flow build process executes arbitrary attacker-supplied code on the Langflow server.

AML.T0050

Impact

Attacker gains full compromise of the Langflow host, exposing embedded LLM API keys, connector credentials, and any systems those credentials reach.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
156.2KPushed 3d ago18% patched~75d to patchFull package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.9%

chance of exploitation in 30 days

Higher than 59% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Patch to the fixed Langflow release above 1.11.2 as soon as IBM publishes it — track https://www.ibm.com/support/pages/node/7285640 for the update. 2) Until patched, restrict flow-build permissions to the minimum set of trusted users and eliminate shared or generic low-privilege accounts. 3) Place Langflow instances behind network-level access controls (VPN, IP allowlisting, or a reverse proxy with authentication) rather than exposing the builder UI directly to the internet. 4) Rotate any credentials (LLM API keys, database secrets, connector tokens) stored inside flows on affected instances as a precaution. 5) Monitor authentication logs and flow-build API calls for privilege escalation patterns — e.g., low-privilege accounts triggering build/execute actions they shouldn't have access to.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth BypassCode ExecutionFrameworkAgentAML.T0012- Valid Accounts AML.T0049- Exploit Public-Facing Application AML.T0050- Command and Scripting Interpreter

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MEASURE 2.7-AI system security and resilience are evaluated and documented

OWASP LLM Top 10

LLM06:2025-Excessive Agency

Frequently Asked Questions

What is CVE-2026-19298?

IBM Langflow OSS versions 1.0.0 through 1.11.2 contain an authorization bypass in the flow build process that lets a remote, already-authenticated user with only low privileges execute arbitrary code on the server, rated CVSS 8.8 with no user interaction required. This matters because Langflow instances typically hold LLM provider API keys, database credentials, and connected data-source secrets inside flow configurations — a successful exploit hands an attacker a foothold to pivot into every downstream system the flow orchestrates, not just the Langflow container itself. There is no evidence of active exploitation (not in CISA KEV, no public PoC, no Nuclei template, EPSS unscored), which lowers immediate urgency but does not eliminate risk given how low the bar is: any low-privilege account, including a shared or weakly-provisioned one, is sufficient. Patch to a fixed release above 1.11.2 as soon as IBM publishes one, and in the interim restrict who can create or build flows, avoid shared low-privilege accounts, place the instance behind network-level access controls, and monitor authentication plus flow-build API logs for privilege anomalies.

Is CVE-2026-19298 actively exploited?

No confirmed active exploitation of CVE-2026-19298 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-19298?

1) Patch to the fixed Langflow release above 1.11.2 as soon as IBM publishes it — track https://www.ibm.com/support/pages/node/7285640 for the update. 2) Until patched, restrict flow-build permissions to the minimum set of trusted users and eliminate shared or generic low-privilege accounts. 3) Place Langflow instances behind network-level access controls (VPN, IP allowlisting, or a reverse proxy with authentication) rather than exposing the builder UI directly to the internet. 4) Rotate any credentials (LLM API keys, database secrets, connector tokens) stored inside flows on affected instances as a precaution. 5) Monitor authentication logs and flow-build API calls for privilege escalation patterns — e.g., low-privilege accounts triggering build/execute actions they shouldn't have access to.

What systems are affected by CVE-2026-19298?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, LLM orchestration pipelines, low-code AI development platforms.

What is the CVSS score for CVE-2026-19298?

CVE-2026-19298 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.88%.

What is the AI security impact?

Affected AI Architectures

agent frameworksLLM orchestration pipelineslow-code AI development platforms

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0049Exploit Public-Facing Application

AML.T0050Command and Scripting Interpreter

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM06:2025

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to execute arbitrary code due to an authorization bypass in the flow build process.

Exploitation Scenario

An attacker obtains or is granted a low-privilege account on an internet- or intranet-facing Langflow instance (e.g., via self-service signup, a shared demo account, or a phished low-tier credential). Using that account, the attacker calls the flow build endpoint and exploits the authorization bypass to have the server execute arbitrary code outside the permissions their account should hold. From there, the attacker has a foothold on the Langflow host itself, allowing them to read flow configurations containing LLM API keys and connector credentials, pivot to connected vector databases or internal APIs, and potentially move laterally into the broader environment those credentials grant access to.

Weaknesses (CWE)

CWE-94Improper Control of Generation of CodePrimary CWE-94Improper Control of Generation of Code

CWE-94 — Improper Control of Generation of Code: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

[Architecture and Design] Refactor your program so that you do not have to dynamically generate code.
[Architecture and Design] Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.