CVE-2026-79724: Langflow unauthenticated OS

CISO Take

IBM Langflow OSS versions 1.0.0 through 1.11.5 contain a command injection flaw (CWE-78) that lets a remote, unauthenticated attacker run arbitrary OS commands on the host simply by sending a crafted network request — no login, no user interaction, low complexity. Langflow is a widely used low-code builder for LLM agents and RAG pipelines, so any internet-reachable or internally-exposed instance effectively hands over the underlying server, including API keys, model credentials, and connected data sources. There is no CISA KEV listing, EPSS score, or public exploit/Nuclei template yet, but the CVSS 9.8 profile (AV:N/AC:L/PR:N/UI:N) is the classic shape for fast, automated exploitation once technical details circulate — Langflow has a track record of similar RCEs being weaponized quickly. Patch to the fixed release immediately, and until then take any Langflow instance off the public internet, restrict access with network controls/VPN, and monitor process execution logs on Langflow hosts for anomalous child processes.

Sources: NVD ATLAS ibm.com

What is the risk?

Critical. The vulnerability requires no authentication and no user interaction, has low attack complexity, and grants full compromise (confidentiality, integrity, and availability all rated High). Although EPSS data is not yet available and the CVE is not in CISA KEV as of publication, the combination of network-reachable attack vector and trivial exploitability makes this a prime candidate for rapid weaponization — the same class of vulnerability (unauthenticated RCE in AI orchestration tooling) has repeatedly seen exploit code and Metasploit modules appear within days of disclosure in comparable frameworks (e.g., Flowise, Langflow's own prior CVEs, Ollama). Any exposed instance should be treated as compromised-by-default until patched.

How does the attack unfold?

Initial Access

Attacker sends a crafted network request to an exposed Langflow instance, exploiting improper neutralization of special characters in an OS command context.

AML.T0049

Execution

The injected payload is executed via the OS command/script interpreter with the privileges of the Langflow process.

AML.T0050

Impact

Attacker achieves full remote code execution, enabling credential theft (LLM API keys, vector DB access), data exfiltration, or pivoting into connected AI pipeline infrastructure.

AML.T0072

Initial Access

Attacker sends a crafted network request to an exposed Langflow instance, exploiting improper neutralization of special characters in an OS command context.

AML.T0049

Execution

The injected payload is executed via the OS command/script interpreter with the privileges of the Langflow process.

AML.T0050

Impact

Attacker achieves full remote code execution, enabling credential theft (LLM API keys, vector DB access), data exfiltration, or pivoting into connected AI pipeline infrastructure.

AML.T0072

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
154.7K Pushed 7d ago 17% patched ~70d to patch Full package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 40% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I High

A High

What should I do?

1 step

1) Upgrade Langflow to the first version beyond 1.11.5 that includes the fix immediately. 2) Until patched, do not expose Langflow's UI/API to the public internet — restrict access to a VPN or internal network with strict allow-listing. 3) Run Langflow with least-privilege OS accounts and container isolation (no root, no unnecessary filesystem/network access) to limit blast radius if exploited. 4) Monitor process execution and outbound network connections from Langflow hosts for unexpected child processes or reverse shells. 5) Rotate any API keys/credentials accessible to the Langflow instance if exposure to untrusted networks is suspected. 6) Check IBM's advisory (linked below) for the exact patched version and any interim workaround.

What does CISA's SSVC say?

Decision Track*

Exploitation none

Automatable Yes

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Framework Agent AML.T0049 - Exploit Public-Facing Application AML.T0050 - Command and Scripting Interpreter AML.T0072 - Reverse Shell

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2 - AI system security controls

NIST AI RMF

MEASURE 2.7 - AI system security and resilience is evaluated and documented

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-79724?

IBM Langflow OSS versions 1.0.0 through 1.11.5 contain a command injection flaw (CWE-78) that lets a remote, unauthenticated attacker run arbitrary OS commands on the host simply by sending a crafted network request — no login, no user interaction, low complexity. Langflow is a widely used low-code builder for LLM agents and RAG pipelines, so any internet-reachable or internally-exposed instance effectively hands over the underlying server, including API keys, model credentials, and connected data sources. There is no CISA KEV listing, EPSS score, or public exploit/Nuclei template yet, but the CVSS 9.8 profile (AV:N/AC:L/PR:N/UI:N) is the classic shape for fast, automated exploitation once technical details circulate — Langflow has a track record of similar RCEs being weaponized quickly. Patch to the fixed release immediately, and until then take any Langflow instance off the public internet, restrict access with network controls/VPN, and monitor process execution logs on Langflow hosts for anomalous child processes.

Is CVE-2026-79724 actively exploited?

No confirmed active exploitation of CVE-2026-79724 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-79724?

1) Upgrade Langflow to the first version beyond 1.11.5 that includes the fix immediately. 2) Until patched, do not expose Langflow's UI/API to the public internet — restrict access to a VPN or internal network with strict allow-listing. 3) Run Langflow with least-privilege OS accounts and container isolation (no root, no unnecessary filesystem/network access) to limit blast radius if exploited. 4) Monitor process execution and outbound network connections from Langflow hosts for unexpected child processes or reverse shells. 5) Rotate any API keys/credentials accessible to the Langflow instance if exposure to untrusted networks is suspected. 6) Check IBM's advisory (linked below) for the exact patched version and any interim workaround.

What systems are affected by CVE-2026-79724?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines, workflow orchestration, low-code AI builders.

What is the CVSS score for CVE-2026-79724?

CVE-2026-79724 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 0.47%.

What is the AI security impact?

Affected AI Architectures

agent frameworksRAG pipelinesworkflow orchestrationlow-code AI builders

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0050 Command and Scripting Interpreter

AML.T0072 Reverse Shell

Compliance Controls Affected

ISO 42001: A.6.2

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to execute arbitrary OS commands due to improper neutralization of special elements used in an OS command.

Exploitation Scenario

An attacker scans for internet-facing Langflow instances (a common pattern given many deployments are spun up for internal AI prototyping without hardening). They send a crafted request to a vulnerable endpoint that fails to properly neutralize special shell characters, injecting an OS command that executes with the privileges of the Langflow process. From there the attacker establishes a reverse shell, harvests LLM API keys and vector DB credentials stored in the Langflow configuration, and pivots to other systems reachable from the compromised host — potentially poisoning or exfiltrating data from any RAG pipelines or agent tools Langflow orchestrates.

Weaknesses (CWE)

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Primary CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-78 — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'): The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

[Architecture and Design] If at all possible, use library calls rather than external processes to recreate the desired functionality.
[Architecture and Design, Operation] Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software. OS-level examples include the Unix chroot jail, AppArmor, and SELinux. In general, managed code may provide some protection. For example, java.io.FilePermission in the Java SecurityManager allows the software to specify restrictions on file operations. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of the application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.