CVE-2026-78569: Langflow incomplete denylist enables

CISO Take

Langflow, IBM's visual builder for LangChain-based agent and RAG workflows, ships a security scanner meant to block dangerous code inside its custom "Python Code" component, but the denylist is incomplete and lets an authenticated, low-privileged user escape it to run arbitrary commands on the host. There's no public exploit code, no Nuclei template, and it isn't in CISA's KEV catalog, so this isn't being mass-exploited today, but the CVSS 8.8 score reflects real severity: network-reachable, low attack complexity, no user interaction, and full compromise of confidentiality, integrity, and availability once triggered. The risk concentrates in any shared or multi-tenant Langflow deployment where non-admin users are allowed to author or edit flows, since PR:L means the bar to exploit is just having a low-privilege account, not admin access. Treat this as a priority patch for any Langflow instance reachable by more than a trusted admin: upgrade past 1.11.5 per IBM's advisory, and until patched, restrict flow-authoring/code-component permissions to trusted users only and isolate the Langflow runtime in a container with no access to host secrets or lateral network paths. Also audit API keys, LLM credentials, and vector DB connection strings the Langflow instance can reach, since those are the most likely exfiltration targets post-exploitation.

Sources: NVD IBM Security Advisory CISA KEV ATLAS

What is the risk?

High severity (CVSS 8.8) but not yet weaponized: no public PoC, no Nuclei template, not in CISA KEV, and EPSS data is unavailable. Exploitability is realistic rather than trivial — it requires an authenticated account (PR:L) and some knowledge of Python sandbox/denylist bypass techniques to craft code that evades the scanner's blocklist, placing it at moderate sophistication rather than script-kiddie level. The main risk driver is exposure: any Langflow instance where non-admin or semi-trusted users can create/edit flows (common in team or customer-facing agent-building setups) effectively grants those users a path to full code execution on the host.

How does the attack unfold?

Initial Access

Attacker obtains or already holds a low-privilege authenticated account on a shared Langflow instance.

AML.T0012

Denylist Bypass & Code Execution

Attacker crafts Python code in the flow's code component that evades the incomplete security scanner denylist to execute arbitrary commands.

AML.T0050

Credential & Data Access

Attacker harvests LLM API keys, vector database credentials, and environment secrets accessible to the Langflow process.

AML.T0025

Impact

Attacker achieves full compromise of confidentiality, integrity, and availability of the Langflow host and any connected AI pipeline resources.

Initial Access

Attacker obtains or already holds a low-privilege authenticated account on a shared Langflow instance.

AML.T0012

Denylist Bypass & Code Execution

Attacker crafts Python code in the flow's code component that evades the incomplete security scanner denylist to execute arbitrary commands.

AML.T0050

Credential & Data Access

Attacker harvests LLM API keys, vector database credentials, and environment secrets accessible to the Langflow process.

AML.T0025

Impact

Attacker achieves full compromise of confidentiality, integrity, and availability of the Langflow host and any connected AI pipeline resources.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
154.7K Pushed 7d ago 17% patched ~70d to patch Full package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 39% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I High

A High

What should I do?

1 step

Upgrade Langflow to the version fixed after 1.11.5 per IBM's security advisory (https://www.ibm.com/support/pages/node/7286666) as soon as it's validated in a staging environment. Until patched, restrict who can create or edit flows containing custom code components to fully trusted/admin users only, and disable or gate the code component for lower-privilege roles if your Langflow role model supports it. Run Langflow in an isolated container/VM with minimal host privileges, no mounted secrets beyond what's strictly needed, and network egress restrictions to limit blast radius if the sandbox is bypassed. For detection, monitor Langflow's process tree for unexpected child processes (shells, network tools) spawned from the application process, and review recently created/modified flows for anomalous Python code component content.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Framework Agent AML.T0012 - Valid Accounts AML.T0025 - Exfiltration via Cyber Means AML.T0050 - Command and Scripting Interpreter

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.4 - Security of AI systems

NIST AI RMF

MEASURE 2.7 - AI system security and resilience is evaluated and documented

OWASP LLM Top 10

LLM06:2025 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-78569?

Langflow, IBM's visual builder for LangChain-based agent and RAG workflows, ships a security scanner meant to block dangerous code inside its custom "Python Code" component, but the denylist is incomplete and lets an authenticated, low-privileged user escape it to run arbitrary commands on the host. There's no public exploit code, no Nuclei template, and it isn't in CISA's KEV catalog, so this isn't being mass-exploited today, but the CVSS 8.8 score reflects real severity: network-reachable, low attack complexity, no user interaction, and full compromise of confidentiality, integrity, and availability once triggered. The risk concentrates in any shared or multi-tenant Langflow deployment where non-admin users are allowed to author or edit flows, since PR:L means the bar to exploit is just having a low-privilege account, not admin access. Treat this as a priority patch for any Langflow instance reachable by more than a trusted admin: upgrade past 1.11.5 per IBM's advisory, and until patched, restrict flow-authoring/code-component permissions to trusted users only and isolate the Langflow runtime in a container with no access to host secrets or lateral network paths. Also audit API keys, LLM credentials, and vector DB connection strings the Langflow instance can reach, since those are the most likely exfiltration targets post-exploitation.

Is CVE-2026-78569 actively exploited?

No confirmed active exploitation of CVE-2026-78569 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-78569?

Upgrade Langflow to the version fixed after 1.11.5 per IBM's security advisory (https://www.ibm.com/support/pages/node/7286666) as soon as it's validated in a staging environment. Until patched, restrict who can create or edit flows containing custom code components to fully trusted/admin users only, and disable or gate the code component for lower-privilege roles if your Langflow role model supports it. Run Langflow in an isolated container/VM with minimal host privileges, no mounted secrets beyond what's strictly needed, and network egress restrictions to limit blast radius if the sandbox is bypassed. For detection, monitor Langflow's process tree for unexpected child processes (shells, network tools) spawned from the application process, and review recently created/modified flows for anomalous Python code component content.

What systems are affected by CVE-2026-78569?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines, model serving.

What is the CVSS score for CVE-2026-78569?

CVE-2026-78569 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.46%.

What is the AI security impact?

Affected AI Architectures

agent frameworksRAG pipelinesmodel serving

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0025 Exfiltration via Cyber Means

AML.T0050 Command and Scripting Interpreter

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.4

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM06:2025

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.11.5 could allow an authenticated attacker to execute arbitrary code due to an incomplete denylist in the security scanner.

Exploitation Scenario

An attacker obtains or is granted a low-privilege authenticated account on a shared Langflow instance (e.g., a team member with flow-editing rights but not admin access). They create or modify a flow using the Python Code component and craft code that evades the scanner's denylist — for example, referencing blocked modules like `os` or `subprocess` indirectly through builtins introspection or obfuscated attribute access rather than a direct blocked import statement. When the flow is executed (by the attacker, a scheduled run, or another user), the code runs with the privileges of the Langflow process, giving the attacker a shell or command execution on the host. From there they harvest environment variables and connected credentials (LLM API keys, vector DB secrets), and potentially pivot further into the network the Langflow container can reach.

Weaknesses (CWE)

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Primary CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-78 — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'): The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

[Architecture and Design] If at all possible, use library calls rather than external processes to recreate the desired functionality.
[Architecture and Design, Operation] Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software. OS-level examples include the Unix chroot jail, AppArmor, and SELinux. In general, managed code may provide some protection. For example, java.io.FilePermission in the Java SecurityManager allows the software to specify restrictions on file operations. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of the application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.