CVE-2026-7871: Langflow Redis-access

CISO Take

IBM Langflow OSS versions 1.0.0 through 1.10.0 contain an insecure deserialization flaw (CWE-502) that lets anyone with access to the deployment's Redis instance execute arbitrary code with full application privileges, exposing every secret, credential, and dataset the app touches. This is a maximum-severity bug (CVSS 9.8, network vector, no privileges or user interaction required) in a widely-used framework for building LLM and agentic applications, which makes it attractive both to opportunistic scanners hunting exposed Redis endpoints and to attackers already inside a network perimeter. There is no confirmed active exploitation yet — it's not in CISA KEV, no public PoC or Nuclei template exists, and EPSS sits at 0.386% (roughly the 69th percentile) — but the combination of trivial-to-scan Redis misconfigurations and unauthenticated deserialization means the exploitation bar is low once an exposed instance is found. Patch to the version specified in IBM's advisory (beyond 1.10.0) immediately; in the interim, ensure Redis is bound to a private network, require AUTH/ACL, and rotate any LLM API keys or credentials the Langflow instance had access to if Redis exposure cannot be ruled out. Monitor Redis for anomalous writes and Langflow processes for unexpected child processes or outbound connections as compensating detection.

Sources: NVD EPSS CISA KEV ibm.com ATLAS

What is the risk?

Critical. The CVSS 9.8 score reflects a network-exploitable, unauthenticated-from-the-app's-perspective code execution primitive with no user interaction — the only real precondition is reachability of the backing Redis instance, which in practice is a common misconfiguration (default installs frequently ship Redis without AUTH bound to non-loopback interfaces). Exploitability signals are currently low (EPSS 0.386%, top 69th percentile; not in CISA KEV; no public exploit or scanner template), so this reads as high-severity-but-not-yet-weaponized. That can change quickly given deserialization bugs are well-understood attack patterns and Langflow's growing adoption as an agent-building framework increases the value of a working exploit.

How does the attack unfold?

Redis Access

Attacker obtains network or credential access to the Redis instance backing the Langflow deployment, often exposed without authentication.

AML.T0049

Malicious Deserialization

Attacker writes a crafted serialized payload into Redis that Langflow deserializes (CWE-502), triggering arbitrary code execution in the app process.

AML.T0106

Secrets & Data Compromise

Code execution runs with full Langflow application privileges, exposing LLM API keys, database credentials, and stored flow/agent data.

AML.T0055

Full System Compromise

Attacker leverages compromised credentials and code execution to pivot into shared infrastructure or manipulate agentic flows for persistence.

AML.T0112

Redis Access

Attacker obtains network or credential access to the Redis instance backing the Langflow deployment, often exposed without authentication.

AML.T0049

Malicious Deserialization

Attacker writes a crafted serialized payload into Redis that Langflow deserializes (CWE-502), triggering arbitrary code execution in the app process.

AML.T0106

Secrets & Data Compromise

Code execution runs with full Langflow application privileges, exposing LLM API keys, database credentials, and stored flow/agent data.

AML.T0055

Full System Compromise

Attacker leverages compromised credentials and code execution to pivot into shared infrastructure or manipulate agentic flows for persistence.

AML.T0112

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
153.0K Pushed 6d ago 26% patched ~70d to patch Full package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 37% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I High

A High

What should I do?

1 step

1) Upgrade Langflow to the patched release referenced in IBM's advisory (any version beyond 1.10.0). 2) If immediate patching isn't possible, restrict Redis to a private network/loopback only, enforce AUTH and ACLs, and disable dangerous commands (EVAL, FLUSHALL, CONFIG) via ACL rules. 3) Audit external exposure of Redis instances tied to Langflow deployments (internal asset scans or Shodan-style checks for port 6379 without auth). 4) Rotate all secrets (LLM API keys, DB credentials, service tokens) accessible to any Langflow instance where Redis exposure cannot be conclusively ruled out. 5) Add detection for anomalous Redis writes/reads and for unexpected child processes or outbound network connections spawned by the Langflow process.

What does CISA's SSVC say?

Decision Track*

Exploitation none

Automatable Yes

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Data Leakage Framework Agent AML.T0049 - Exploit Public-Facing Application AML.T0055 - Unsecured Credentials AML.T0106 - Exploitation for Credential Access AML.T0112 - Machine Compromise

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.3 - AI system security testing and vulnerability management

NIST AI RMF

MANAGE 4.1 - Risk response and remediation of deployed AI systems

OWASP LLM Top 10

LLM05 - Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2026-7871?

IBM Langflow OSS versions 1.0.0 through 1.10.0 contain an insecure deserialization flaw (CWE-502) that lets anyone with access to the deployment's Redis instance execute arbitrary code with full application privileges, exposing every secret, credential, and dataset the app touches. This is a maximum-severity bug (CVSS 9.8, network vector, no privileges or user interaction required) in a widely-used framework for building LLM and agentic applications, which makes it attractive both to opportunistic scanners hunting exposed Redis endpoints and to attackers already inside a network perimeter. There is no confirmed active exploitation yet — it's not in CISA KEV, no public PoC or Nuclei template exists, and EPSS sits at 0.386% (roughly the 69th percentile) — but the combination of trivial-to-scan Redis misconfigurations and unauthenticated deserialization means the exploitation bar is low once an exposed instance is found. Patch to the version specified in IBM's advisory (beyond 1.10.0) immediately; in the interim, ensure Redis is bound to a private network, require AUTH/ACL, and rotate any LLM API keys or credentials the Langflow instance had access to if Redis exposure cannot be ruled out. Monitor Redis for anomalous writes and Langflow processes for unexpected child processes or outbound connections as compensating detection.

Is CVE-2026-7871 actively exploited?

No confirmed active exploitation of CVE-2026-7871 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-7871?

1) Upgrade Langflow to the patched release referenced in IBM's advisory (any version beyond 1.10.0). 2) If immediate patching isn't possible, restrict Redis to a private network/loopback only, enforce AUTH and ACLs, and disable dangerous commands (EVAL, FLUSHALL, CONFIG) via ACL rules. 3) Audit external exposure of Redis instances tied to Langflow deployments (internal asset scans or Shodan-style checks for port 6379 without auth). 4) Rotate all secrets (LLM API keys, DB credentials, service tokens) accessible to any Langflow instance where Redis exposure cannot be conclusively ruled out. 5) Add detection for anomalous Redis writes/reads and for unexpected child processes or outbound network connections spawned by the Langflow process.

What systems are affected by CVE-2026-7871?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, LLM app builder pipelines, shared caching/task-queue infrastructure.

What is the CVSS score for CVE-2026-7871?

CVE-2026-7871 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 0.45%.

What is the AI security impact?

Affected AI Architectures

agent frameworksLLM app builder pipelinesshared caching/task-queue infrastructure

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0055 Unsecured Credentials

AML.T0106 Exploitation for Credential Access

AML.T0112 Machine Compromise

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.3

NIST AI RMF: MANAGE 4.1

OWASP LLM Top 10: LLM05

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.10.0 allows users with Redis access to execute arbitrary code with full application privileges, compromising all secrets, data, and system integrity.

Exploitation Scenario

An attacker scans for internet-facing or internally reachable Redis instances lacking authentication and identifies one backing a Langflow deployment. They craft a malicious serialized Python object and write it to a Redis key or queue that Langflow reads and deserializes as part of its normal caching or task-processing flow. When Langflow processes the entry, the insecure deserialization (CWE-502) triggers execution of the attacker's payload within the application process, granting full application privileges. From there the attacker harvests LLM API keys and database credentials stored in the app's environment, exfiltrates flow data and any RAG-indexed content, and potentially pivots to other services sharing the same Redis instance.

Weaknesses (CWE)

CWE-502 Deserialization of Untrusted Data Primary CWE-502 Deserialization of Untrusted Data

CWE-502 — Deserialization of Untrusted Data: The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

[Architecture and Design, Implementation] If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
[Implementation] When deserializing data, populate a new object rather than just deserializing. The result is that the data flows through safe input validation and that the functions are safe.

Source: MITRE CWE corpus.