CVE-2026-7873: Langflow authenticated RCE enables

CISO Take

IBM Langflow, a widely used low-code framework for building LLM and agent pipelines, contains a critical OS command injection flaw (CWE-94) that lets any authenticated user execute arbitrary commands and read sensitive files including credentials, resulting in complete system compromise. The CVSS score of 9.9 reflects a near-maximal blast radius — network-exploitable, low complexity, no user interaction, and a scope change meaning impact extends beyond the Langflow process itself into connected systems and stored secrets. There's no public exploit, no Nuclei scanner template, and it isn't in CISA's KEV catalog, and EPSS puts real-world exploitation probability at just 0.294%, so this is not yet under active mass exploitation — but the low privilege bar (PR:L) means any low-trust account, including a self-service signup, is enough to trigger it. Given Langflow's role orchestrating LLM APIs, vector databases, and agent tool credentials, treat this as a priority patch: upgrade beyond 1.10.0 immediately, and until patched, restrict Langflow access to trusted authenticated users only and monitor for anomalous OS-level command execution from the Langflow process.

Sources: NVD EPSS ATLAS ibm.com

What is the risk?

CVSS 9.9 places this among the most severe vulnerability classes possible — network attack vector, low complexity, no user interaction required, and a scope change (S:C) indicating the vulnerable component can impact resources outside its own security boundary. The requirement for low-privilege authentication (PR:L) is the only mitigating factor, but in practice many Langflow deployments allow self-registration or broad internal access, effectively lowering this bar to near-zero. EPSS (0.294%) and absence from CISA KEV indicate no confirmed active exploitation yet, and the lack of a public PoC or Nuclei template means opportunistic scanning is unlikely in the immediate term. However, the technique (OS command injection) is well understood and trivially weaponizable once details circulate, so risk should be treated as high and time-sensitive despite the currently low EPSS.

How does the attack unfold?

Initial Access

Attacker obtains a low-privilege authenticated account on the target Langflow instance.

AML.T0012

Exploitation

Attacker abuses the CWE-94 code injection flaw to execute arbitrary OS commands on the host.

AML.T0050

Credential Access

Attacker reads local files and configs to harvest API keys and database credentials stored by Langflow.

AML.T0055

Impact

Attacker uses harvested credentials to pivot laterally into connected AI infrastructure, achieving full system compromise.

Initial Access

Attacker obtains a low-privilege authenticated account on the target Langflow instance.

AML.T0012

Exploitation

Attacker abuses the CWE-94 code injection flaw to execute arbitrary OS commands on the host.

AML.T0050

Credential Access

Attacker reads local files and configs to harvest API keys and database credentials stored by Langflow.

AML.T0055

Impact

Attacker uses harvested credentials to pivot laterally into connected AI infrastructure, achieving full system compromise.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
153.0K Pushed 6d ago 26% patched ~70d to patch Full package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

9.9 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 26% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Changed

C High

I High

A High

What should I do?

1 step

Patch Langflow to a version beyond 1.10.0 as soon as IBM/Langflow publishes the fixed release referenced in the advisory. Until patched, restrict network exposure of Langflow instances (no public internet exposure of the UI/API), enforce strict authentication and minimize the number of users with any account on the instance, and apply least-privilege to the service account running Langflow so command execution cannot reach broader infrastructure. Rotate any API keys, database credentials, or secrets stored in or accessible to Langflow flows on affected instances as a precaution. For detection, monitor host-level process execution and audit logs for unexpected child processes spawned by the Langflow service, and alert on file-read access to credential/config paths from the Langflow process.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Data Leakage Privacy Violation Framework Agent AML.T0012 - Valid Accounts AML.T0049 - Exploit Public-Facing Application AML.T0050 - Command and Scripting Interpreter AML.T0055 - Unsecured Credentials

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6 - AI system security

NIST AI RMF

MANAGE 4.1 - Post-deployment AI system monitoring for risks and impacts

OWASP LLM Top 10

LLM03 - Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2026-7873?

IBM Langflow, a widely used low-code framework for building LLM and agent pipelines, contains a critical OS command injection flaw (CWE-94) that lets any authenticated user execute arbitrary commands and read sensitive files including credentials, resulting in complete system compromise. The CVSS score of 9.9 reflects a near-maximal blast radius — network-exploitable, low complexity, no user interaction, and a scope change meaning impact extends beyond the Langflow process itself into connected systems and stored secrets. There's no public exploit, no Nuclei scanner template, and it isn't in CISA's KEV catalog, and EPSS puts real-world exploitation probability at just 0.294%, so this is not yet under active mass exploitation — but the low privilege bar (PR:L) means any low-trust account, including a self-service signup, is enough to trigger it. Given Langflow's role orchestrating LLM APIs, vector databases, and agent tool credentials, treat this as a priority patch: upgrade beyond 1.10.0 immediately, and until patched, restrict Langflow access to trusted authenticated users only and monitor for anomalous OS-level command execution from the Langflow process.

Is CVE-2026-7873 actively exploited?

No confirmed active exploitation of CVE-2026-7873 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-7873?

Patch Langflow to a version beyond 1.10.0 as soon as IBM/Langflow publishes the fixed release referenced in the advisory. Until patched, restrict network exposure of Langflow instances (no public internet exposure of the UI/API), enforce strict authentication and minimize the number of users with any account on the instance, and apply least-privilege to the service account running Langflow so command execution cannot reach broader infrastructure. Rotate any API keys, database credentials, or secrets stored in or accessible to Langflow flows on affected instances as a precaution. For detection, monitor host-level process execution and audit logs for unexpected child processes spawned by the Langflow service, and alert on file-read access to credential/config paths from the Langflow process.

What systems are affected by CVE-2026-7873?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines, model serving.

What is the CVSS score for CVE-2026-7873?

CVE-2026-7873 has a CVSS v3.1 base score of 9.9 (CRITICAL). The EPSS exploitation probability is 0.34%.

What is the AI security impact?

Affected AI Architectures

agent frameworksRAG pipelinesmodel serving

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0049 Exploit Public-Facing Application

AML.T0050 Command and Scripting Interpreter

AML.T0055 Unsecured Credentials

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 4.1

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated attackers to execute arbitrary OS commands and read sensitive files including credentials, enabling complete system compromise and lateral movement.

Exploitation Scenario

An attacker first obtains a low-privilege authenticated account on a target Langflow instance — via self-registration where enabled, credential stuffing, or a phished internal user. Using that access, they invoke the vulnerable component to inject and execute arbitrary OS commands (CWE-94) on the underlying host or container. From there they read local files such as `.env` configs or credential stores that Langflow flows rely on for LLM API keys and vector database connections. With those harvested credentials, the attacker pivots into connected AI infrastructure and internal systems, achieving lateral movement and full compromise well beyond the original Langflow deployment.

Weaknesses (CWE)

CWE-94 Improper Control of Generation of Code ('Code Injection') Primary CWE-94 Improper Control of Generation of Code ('Code Injection')

CWE-94 — Improper Control of Generation of Code ('Code Injection'): The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

[Architecture and Design] Refactor your program so that you do not have to dynamically generate code.
[Architecture and Design] Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.