CVE-2026-78575: Langflow RCE — HIGH

CISO Take

IBM Langflow, an open-source platform for building LLM and agent workflows, contains a command injection flaw (CVSS 8.8) in how it validates command-line arguments passed to MCP stdio server configurations, letting an authenticated low-privilege user execute arbitrary OS commands on the host. There's no EPSS score, no CISA KEV listing, and no public exploit or Nuclei template yet, so mass exploitation isn't imminent, but the bar to trigger it is low complexity and needs no user interaction once an attacker has any authenticated seat — a realistic bar in multi-tenant or team Langflow deployments where flow-editing access is broadly granted. Full compromise of confidentiality, integrity, and availability means an attacker who lands this gets the Langflow service account's access to every other flow's credentials and any connected downstream systems (databases, cloud APIs, secrets). Patch to the version above 1.11.5 referenced in IBM's advisory, and in the interim restrict who can create or edit MCP stdio server tool configs to trusted admins only. Monitor the Langflow host for anomalous child processes spawned by the Langflow service account as a compensating detection control until patched.

Sources: NVD ATLAS ibm.com

What is the risk?

High severity by CVSS (8.8, full C/I/A impact, network vector, low complexity, no user interaction), but exploitability in practice is gated by the PR:L requirement — an attacker needs at least a low-privilege authenticated account on the Langflow instance. No EPSS data, no CISA KEV entry, no public exploit code, and no Nuclei template exist today, so this is not yet a mass-exploited or weaponized bug. The real risk driver is deployment context: Langflow instances that grant flow-editing access broadly (shared dev teams, internal AI platform users, low-trust tenants) effectively hand out the PR:L bar for free, turning a theoretically 'authenticated' vuln into something closer to any-insider-RCE. Treat as high priority for patching, especially for internet-facing or multi-tenant Langflow deployments.

How does the attack unfold?

Initial Access

Attacker authenticates to Langflow with a low-privilege account that has flow-editing access.

AML.T0012

Malicious Configuration

Attacker creates or edits an MCP stdio server tool configuration in a flow, embedding malicious command-line arguments.

AML.T0081

Command Execution

Langflow spawns the MCP stdio server process using the unsanitized arguments, executing arbitrary OS commands under the service account.

AML.T0050

Impact

Attacker achieves full compromise of the Langflow host, gaining access to other flows' credentials and any connected downstream AI infrastructure.

AML.T0112

Initial Access

Attacker authenticates to Langflow with a low-privilege account that has flow-editing access.

AML.T0012

Malicious Configuration

Attacker creates or edits an MCP stdio server tool configuration in a flow, embedding malicious command-line arguments.

AML.T0081

Command Execution

Langflow spawns the MCP stdio server process using the unsanitized arguments, executing arbitrary OS commands under the service account.

AML.T0050

Impact

Attacker achieves full compromise of the Langflow host, gaining access to other flows' credentials and any connected downstream AI infrastructure.

AML.T0112

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
154.7K Pushed 7d ago 17% patched ~70d to patch Full package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 43% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I High

A High

What should I do?

1 step

1) Upgrade IBM Langflow OSS beyond 1.11.5 per the IBM support advisory (https://www.ibm.com/support/pages/node/7286666) as soon as a fixed release is available. 2) Until patched, restrict creation/editing of MCP stdio server configurations to trusted administrators only — remove that capability from standard/low-privilege user roles via RBAC. 3) Audit existing flows for suspicious or unexpected command-line arguments in MCP stdio server configs. 4) Add host-level detection for anomalous child processes spawned by the Langflow service account (EDR process-lineage rules). 5) Network-segment Langflow instances away from sensitive internal systems and secrets stores where feasible. 6) Review access logs for flow-configuration changes since any Langflow 1.0.0+ deployment to look for retroactive indicators of abuse.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Framework Agent Plugin AML.T0050 - Command and Scripting Interpreter AML.T0053 - AI Agent Tool Invocation AML.T0081 - Modify AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.4 - AI system operation and monitoring

NIST AI RMF

MANAGE-4.1 - Risks and benefits of deployed AI systems are continually monitored

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-78575?

IBM Langflow, an open-source platform for building LLM and agent workflows, contains a command injection flaw (CVSS 8.8) in how it validates command-line arguments passed to MCP stdio server configurations, letting an authenticated low-privilege user execute arbitrary OS commands on the host. There's no EPSS score, no CISA KEV listing, and no public exploit or Nuclei template yet, so mass exploitation isn't imminent, but the bar to trigger it is low complexity and needs no user interaction once an attacker has any authenticated seat — a realistic bar in multi-tenant or team Langflow deployments where flow-editing access is broadly granted. Full compromise of confidentiality, integrity, and availability means an attacker who lands this gets the Langflow service account's access to every other flow's credentials and any connected downstream systems (databases, cloud APIs, secrets). Patch to the version above 1.11.5 referenced in IBM's advisory, and in the interim restrict who can create or edit MCP stdio server tool configs to trusted admins only. Monitor the Langflow host for anomalous child processes spawned by the Langflow service account as a compensating detection control until patched.

Is CVE-2026-78575 actively exploited?

No confirmed active exploitation of CVE-2026-78575 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-78575?

1) Upgrade IBM Langflow OSS beyond 1.11.5 per the IBM support advisory (https://www.ibm.com/support/pages/node/7286666) as soon as a fixed release is available. 2) Until patched, restrict creation/editing of MCP stdio server configurations to trusted administrators only — remove that capability from standard/low-privilege user roles via RBAC. 3) Audit existing flows for suspicious or unexpected command-line arguments in MCP stdio server configs. 4) Add host-level detection for anomalous child processes spawned by the Langflow service account (EDR process-lineage rules). 5) Network-segment Langflow instances away from sensitive internal systems and secrets stores where feasible. 6) Review access logs for flow-configuration changes since any Langflow 1.0.0+ deployment to look for retroactive indicators of abuse.

What systems are affected by CVE-2026-78575?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, MCP tool integrations, LLM orchestration pipelines.

What is the CVSS score for CVE-2026-78575?

CVE-2026-78575 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.52%.

What is the AI security impact?

Affected AI Architectures

agent frameworksMCP tool integrationsLLM orchestration pipelines

MITRE ATLAS Techniques

AML.T0050 Command and Scripting Interpreter

AML.T0053 AI Agent Tool Invocation

AML.T0081 Modify AI Agent Configuration

Compliance Controls Affected

ISO 42001: A.6.2.4

NIST AI RMF: MANAGE-4.1

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary commands due to improper validation of command-line arguments in the MCP stdio server configuration.

Exploitation Scenario

An attacker who has obtained or been granted a low-privilege authenticated account on a Langflow instance (e.g., a junior developer, a semi-trusted internal user, or a compromised low-priv credential) creates or edits a flow's MCP stdio server tool configuration, embedding shell metacharacters or malicious values into the command-line arguments used to launch that MCP server process. When Langflow instantiates or executes the MCP stdio server as part of running the flow, it passes those arguments to the underlying process spawn without proper validation, resulting in arbitrary OS command execution under the Langflow service account. From there the attacker can read other users' stored credentials and flow data, pivot to any systems the Langflow host can reach, and establish persistence on the underlying infrastructure.

Weaknesses (CWE)

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Primary CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-78 — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'): The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

[Architecture and Design] If at all possible, use library calls rather than external processes to recreate the desired functionality.
[Architecture and Design, Operation] Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software. OS-level examples include the Unix chroot jail, AppArmor, and SELinux. In general, managed code may provide some protection. For example, java.io.FilePermission in the Java SecurityManager allows the software to specify restrictions on file operations. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of the application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.