CVE-2026-48519: Langflow unauthenticated RCE

CISO Take

Langflow's Shareable Playground feature exposes a critical code injection flaw: any attacker with access to a shared flow URL can execute arbitrary Python on the server by injecting malicious code into the node template field of the unauthenticated public build endpoint, achieving full server takeover without credentials. With a CVSS of 9.6 (scope changed, full C/I/A impact) and a detailed proof-of-concept already published in the GitHub security advisory, exploitation is trivially scriptable — a single crafted cURL command is all that is required. EPSS sits at the 74th percentile and will rise sharply as the PoC circulates; this is not in CISA KEV yet, but the combination of zero-auth, publicly documented PoC, and critical impact on widely deployed AI infrastructure makes active exploitation highly probable in days, not weeks. Upgrade to langflow 1.9.2 immediately; if patching is not possible, disable Shareable Playground and block /api/v1/build_public_tmp at the reverse proxy or WAF, then rotate all API keys and credentials stored in the deployment.

Sources: NVD GitHub Advisory EPSS ATLAS

What is the risk?

Critical exposure for any Langflow deployment running version <= 1.9.1 with at least one flow marked shareable. The attack requires no server-side authentication and minimal attacker effort — a single HTTP request with a modified JSON field achieves RCE. The changed scope (S:C) indicates the vulnerability crosses trust boundaries beyond the Langflow process itself. Langflow is widely deployed in enterprise AI prototyping and internal tooling where it routinely stores LLM API keys, database credentials, and has access to internal network resources, dramatically amplifying post-exploitation blast radius. The package carries 48 tracked CVEs, reflecting a persistently broad attack surface. EPSS at 74th percentile and public PoC availability elevate this above baseline critical.

How does the attack unfold?

Initial Access

Attacker discovers a Langflow Shareable Playground URL via search engine indexing, leaked link, or by registering an account on the target instance to generate a shareable flow themselves.

AML.T0049

Payload Injection

Attacker sends a crafted POST request to /api/v1/build_public_tmp/<flow-id>/flow substituting arbitrary Python code into the data.nodes[X].data.node.template.code.value field of the JSON body — no authentication token required.

AML.T0050

Code Execution

Langflow's flow builder instantiates the node component and evaluates the injected Python at load time within the server process, achieving arbitrary RCE as the Langflow service account.

AML.T0053

Credential Harvest and Pivot

Attacker exfiltrates LLM API keys, database credentials, and internal service tokens from the compromised environment, or establishes a reverse shell for persistent access and lateral movement to connected systems.

AML.T0083

Initial Access

Attacker discovers a Langflow Shareable Playground URL via search engine indexing, leaked link, or by registering an account on the target instance to generate a shareable flow themselves.

AML.T0049

Payload Injection

Attacker sends a crafted POST request to /api/v1/build_public_tmp/<flow-id>/flow substituting arbitrary Python code into the data.nodes[X].data.node.template.code.value field of the JSON body — no authentication token required.

AML.T0050

Code Execution

Langflow's flow builder instantiates the node component and evaluates the injected Python at load time within the server process, achieving arbitrary RCE as the Langflow service account.

AML.T0053

Credential Harvest and Pivot

Attacker exfiltrates LLM API keys, database credentials, and internal service tokens from the compromised environment, or establishes a reverse shell for persistent access and lateral movement to connected systems.

AML.T0083

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	<= 1.9.1	`1.9.2`
152.4K Pushed 6d ago 27% patched ~70d to patch Full package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

9.6 / 10

EPSS

0.8%

chance of exploitation in 30 days

Higher than 54% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR None

UI Required

S Changed

C High

I High

A High

What should I do?

5 steps

Patch immediately: upgrade langflow to >= 1.9.2 which closes this endpoint.
Workaround if immediate patching is not possible: disable Shareable Playground in Langflow settings and block POST requests to /api/v1/build_public_tmp at the reverse proxy or WAF layer.
Detection: audit server access logs for POST requests to /api/v1/build_public_tmp; any payload containing non-default template.code.value fields is a strong indicator of exploitation attempts. Monitor for unusual child processes spawned from the Langflow worker, unexpected outbound connections, and writes to /tmp from the Langflow process.
Post-incident response: rotate all API keys stored in Langflow environment variables or connected integrations (LLM providers, databases, vector stores). Review Langflow audit logs for all flows that were shared and executed during the exposure window.
Harden: never expose Langflow's API port (default 7860) directly to the internet; enforce network-level controls limiting build API access to authenticated internal networks only.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Auth Bypass Framework Agent AML.T0049 - Exploit Public-Facing Application AML.T0050 - Command and Scripting Interpreter AML.T0053 - AI Agent Tool Invocation AML.T0072 - Reverse Shell AML.T0083 - Credentials from AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.9.7 - Information security for AI systems

NIST AI RMF

MANAGE 2.2 - Risk tolerance policies, processes and procedures

OWASP LLM Top 10

LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-48519?

Langflow's Shareable Playground feature exposes a critical code injection flaw: any attacker with access to a shared flow URL can execute arbitrary Python on the server by injecting malicious code into the node template field of the unauthenticated public build endpoint, achieving full server takeover without credentials. With a CVSS of 9.6 (scope changed, full C/I/A impact) and a detailed proof-of-concept already published in the GitHub security advisory, exploitation is trivially scriptable — a single crafted cURL command is all that is required. EPSS sits at the 74th percentile and will rise sharply as the PoC circulates; this is not in CISA KEV yet, but the combination of zero-auth, publicly documented PoC, and critical impact on widely deployed AI infrastructure makes active exploitation highly probable in days, not weeks. Upgrade to langflow 1.9.2 immediately; if patching is not possible, disable Shareable Playground and block /api/v1/build_public_tmp at the reverse proxy or WAF, then rotate all API keys and credentials stored in the deployment.

Is CVE-2026-48519 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-48519, increasing the risk of exploitation.

How to fix CVE-2026-48519?

1. Patch immediately: upgrade langflow to >= 1.9.2 which closes this endpoint. 2. Workaround if immediate patching is not possible: disable Shareable Playground in Langflow settings and block POST requests to /api/v1/build_public_tmp at the reverse proxy or WAF layer. 3. Detection: audit server access logs for POST requests to /api/v1/build_public_tmp; any payload containing non-default template.code.value fields is a strong indicator of exploitation attempts. Monitor for unusual child processes spawned from the Langflow worker, unexpected outbound connections, and writes to /tmp from the Langflow process. 4. Post-incident response: rotate all API keys stored in Langflow environment variables or connected integrations (LLM providers, databases, vector stores). Review Langflow audit logs for all flows that were shared and executed during the exposure window. 5. Harden: never expose Langflow's API port (default 7860) directly to the internet; enforce network-level controls limiting build API access to authenticated internal networks only.

What systems are affected by CVE-2026-48519?

This vulnerability affects the following AI/ML architecture patterns: LLM workflow orchestration platforms, No-code/low-code AI builders, Agent frameworks, AI prototyping and internal tooling environments, Multi-model agentic pipelines with shared workspaces.

What is the CVSS score for CVE-2026-48519?

CVE-2026-48519 has a CVSS v3.1 base score of 9.6 (CRITICAL). The EPSS exploitation probability is 0.82%.

What is the AI security impact?

Affected AI Architectures

LLM workflow orchestration platformsNo-code/low-code AI buildersAgent frameworksAI prototyping and internal tooling environmentsMulti-model agentic pipelines with shared workspaces

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0050 Command and Scripting Interpreter

AML.T0053 AI Agent Tool Invocation

AML.T0072 Reverse Shell

AML.T0083 Credentials from AI Agent Configuration

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.9.7

NIST AI RMF: MANAGE 2.2

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.2, the "Shareable Playground" (or "Public Flows" in code) contains a critical RCE vulnerability. Shareable Playground feature works by enabling the execution of workflows by unauthenticated users, by accessing a link. Specifically, it enables the route /api/v1/build_public_tmp to execute any public flow, given a public flow ID. When the route executes the flow, it allows for providing arbitrary custom Python code as the nodes code, inside the JSON payload. The vulnerable field is data.nodes[X].data.node.template.code.value. This vulnerability is fixed in 1.9.2.

Exploitation Scenario

An attacker identifies a Langflow deployment via Shodan or by discovering an exposed shared playground URL through search engine indexing or a leaked link. They either register a free account to generate their own shareable flow, or target an existing public link. With the shared flow ID in hand, they send a single POST request to /api/v1/build_public_tmp/<flow-id>/flow with the Chat Input node's template.code.value field replaced by arbitrary Python — for example, a reverse shell one-liner or a script dumping os.environ to an attacker-controlled server. The Langflow backend instantiates the component, evaluates the Python at load time, and the attacker achieves RCE as the Langflow service account. Within minutes they exfiltrate all LLM API keys (OpenAI, Anthropic, etc.), database connection strings, and internal service credentials, then optionally establish persistent access or pivot to connected internal systems — all without ever authenticating to the Langflow instance.

Weaknesses (CWE)

CWE-94 Improper Control of Generation of Code ('Code Injection') Primary CWE-94 Improper Control of Generation of Code ('Code Injection') Primary CWE-94 Improper Control of Generation of Code ('Code Injection')

CWE-94 — Improper Control of Generation of Code ('Code Injection'): The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

[Architecture and Design] Refactor your program so that you do not have to dynamically generate code.
[Architecture and Design] Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.