CVE-2026-78571: Langflow authenticated RCE

CISO Take

IBM Langflow, an open-source visual builder for LLM agent workflows, contains an unguarded eval() call that lets any authenticated user — even one with low privileges — execute arbitrary code on the server hosting the platform. This matters because Langflow instances typically hold connected credentials for LLM APIs, vector databases, and downstream tools, so a single compromised low-priv account (self-signup, shared demo credentials, or a leaked API-derived session) becomes a path to full host compromise and lateral movement into the rest of the AI stack. There is no CISA KEV listing, no published EPSS score, and no known public exploit or Nuclei template as of publication, so this is not yet a mass-exploitation event — but CVSS 8.8 (AV:N/AC:L/PR:L/UI:N) means the bar to exploit is low once a working payload is written, and eval()-based RCE in Python code-execution components is a well-understood bug class attackers reverse-engineer quickly from patch diffs. Upgrade past Langflow 1.11.5 immediately, and in the interim restrict Langflow UI/API access to trusted networks (VPN/allowlist), tighten account provisioning so low-privilege accounts can't reach custom-code components, and monitor Langflow server processes for unexpected child processes or outbound connections consistent with post-exploitation activity.

Sources: NVD ATLAS ibm.com

What is the risk?

High severity (CVSS 8.8) with network attack vector, low attack complexity, no user interaction, and only low privileges required — a materially low bar for an authenticated-RCE bug. The absence of a KEV listing, EPSS score, public exploit, or Nuclei template indicates no confirmed active exploitation yet, so near-term risk is elevated-but-not-imminent rather than critical. However, unguarded eval() on attacker-controlled input is a well-known, easily weaponizable bug class (CWE-94), and Langflow's growing adoption as an agent-orchestration tool makes it an attractive target once a PoC surfaces. Organizations exposing Langflow to any authenticated user base (including self-service signup, shared/demo tenants, or broad internal access) should treat this as urgent-patch priority even without confirmed in-the-wild exploitation.

How does the attack unfold?

Initial Access

Attacker obtains low-privileged authenticated credentials to a Langflow instance, e.g. via open self-registration or a shared/demo account.

AML.T0012

Exploitation

Attacker crafts a flow or component containing a malicious Python expression that reaches the unguarded eval() call.

AML.T0049

Code Execution

eval() executes the attacker's payload server-side, granting arbitrary code execution in the context of the Langflow process.

AML.T0050

Impact

Attacker harvests LLM API keys and connected credentials from the compromised host and pivots to downstream AI services or infrastructure.

AML.T0025

Initial Access

Attacker obtains low-privileged authenticated credentials to a Langflow instance, e.g. via open self-registration or a shared/demo account.

AML.T0012

Exploitation

Attacker crafts a flow or component containing a malicious Python expression that reaches the unguarded eval() call.

AML.T0049

Code Execution

eval() executes the attacker's payload server-side, granting arbitrary code execution in the context of the Langflow process.

AML.T0050

Impact

Attacker harvests LLM API keys and connected credentials from the compromised host and pivots to downstream AI services or infrastructure.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
154.7K Pushed 7d ago 17% patched ~70d to patch Full package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.6%

chance of exploitation in 30 days

Higher than 45% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I High

A High

What should I do?

1 step

1) Upgrade Langflow to a patched release above 1.11.5 immediately (check IBM's advisory at the referenced support page for the exact fixed version). 2) Until patched, restrict network exposure of Langflow instances — place behind VPN/IP allowlisting rather than public internet access. 3) Review and tighten account provisioning: disable open self-registration and limit which authenticated users can create/edit flows with custom code components. 4) Audit existing flows/components for suspicious Python expressions or unexpected eval-style constructs. 5) Monitor the Langflow host for anomalous child processes, unexpected outbound network connections, or file system writes originating from the Langflow service account. 6) Rotate any API keys/credentials stored in or accessible to the Langflow instance as a precaution if exposure is suspected.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Framework Agent AML.T0012 - Valid Accounts AML.T0049 - Exploit Public-Facing Application AML.T0050 - Command and Scripting Interpreter

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

Clause 8.1 - Operational planning and control

NIST AI RMF

MANAGE-4.1 - AI risks and benefits are monitored and communicated

OWASP LLM Top 10

LLM05 - Improper Output Handling

Frequently Asked Questions

What is CVE-2026-78571?

IBM Langflow, an open-source visual builder for LLM agent workflows, contains an unguarded eval() call that lets any authenticated user — even one with low privileges — execute arbitrary code on the server hosting the platform. This matters because Langflow instances typically hold connected credentials for LLM APIs, vector databases, and downstream tools, so a single compromised low-priv account (self-signup, shared demo credentials, or a leaked API-derived session) becomes a path to full host compromise and lateral movement into the rest of the AI stack. There is no CISA KEV listing, no published EPSS score, and no known public exploit or Nuclei template as of publication, so this is not yet a mass-exploitation event — but CVSS 8.8 (AV:N/AC:L/PR:L/UI:N) means the bar to exploit is low once a working payload is written, and eval()-based RCE in Python code-execution components is a well-understood bug class attackers reverse-engineer quickly from patch diffs. Upgrade past Langflow 1.11.5 immediately, and in the interim restrict Langflow UI/API access to trusted networks (VPN/allowlist), tighten account provisioning so low-privilege accounts can't reach custom-code components, and monitor Langflow server processes for unexpected child processes or outbound connections consistent with post-exploitation activity.

Is CVE-2026-78571 actively exploited?

No confirmed active exploitation of CVE-2026-78571 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-78571?

1) Upgrade Langflow to a patched release above 1.11.5 immediately (check IBM's advisory at the referenced support page for the exact fixed version). 2) Until patched, restrict network exposure of Langflow instances — place behind VPN/IP allowlisting rather than public internet access. 3) Review and tighten account provisioning: disable open self-registration and limit which authenticated users can create/edit flows with custom code components. 4) Audit existing flows/components for suspicious Python expressions or unexpected eval-style constructs. 5) Monitor the Langflow host for anomalous child processes, unexpected outbound network connections, or file system writes originating from the Langflow service account. 6) Rotate any API keys/credentials stored in or accessible to the Langflow instance as a precaution if exposure is suspected.

What systems are affected by CVE-2026-78571?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, LLM orchestration pipelines, low-code/no-code AI pipeline builders.

What is the CVSS score for CVE-2026-78571?

CVE-2026-78571 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.55%.

What is the AI security impact?

Affected AI Architectures

agent frameworksLLM orchestration pipelineslow-code/no-code AI pipeline builders

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0049 Exploit Public-Facing Application

AML.T0050 Command and Scripting Interpreter

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: Clause 8.1

NIST AI RMF: MANAGE-4.1

OWASP LLM Top 10: LLM05

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to an unguarded eval() call on attacker-controlled input.

Exploitation Scenario

An attacker obtains low-privileged credentials to a Langflow instance — for example through open self-registration, a shared demo/trial account, or a leaked session token. Using that access, they create or edit a flow that includes a custom code or expression field, embedding a malicious Python payload designed to trigger the unguarded eval() call server-side. When the flow is saved or executed, Langflow evaluates the attacker's payload in the context of the server process, granting the attacker arbitrary code execution on the host. From there, the attacker harvests LLM API keys and connected service credentials stored in Langflow's configuration, and pivots to other systems reachable from the compromised host — including vector databases, internal APIs, or downstream automation the Langflow instance orchestrates.

Weaknesses (CWE)

CWE-94 Improper Control of Generation of Code ('Code Injection') Primary CWE-94 Improper Control of Generation of Code ('Code Injection')

CWE-94 — Improper Control of Generation of Code ('Code Injection'): The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

[Architecture and Design] Refactor your program so that you do not have to dynamically generate code.
[Architecture and Design] Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.