CVE-2026-79725: Langflow authenticated arbitrary

CISO Take

IBM Langflow OSS versions 1.0.0 through 1.11.5 contain an improper access control flaw (CWE-284) that lets a remote, already-authenticated user read arbitrary files on the host, with no user interaction required and low attack complexity. Confidentiality impact is rated high while integrity and availability are unaffected, and IBM has not published an EPSS score, the flaw is not in CISA KEV, and no public exploit code or Nuclei template exists today — so this is not an emergency, but Langflow is widely used to build and orchestrate LLM agent workflows, meaning a compromised low-privilege account could pull environment variables, provider API keys, or other users' flow definitions off the host. Because exploitation only requires a valid low-privilege login (PR:L) and no special conditions, any multi-tenant or shared Langflow deployment should treat this as a near-term patch priority rather than a background item. Upgrade to the IBM-supplied fixed release above 1.11.5 immediately, and in the interim tighten account provisioning and audit which users hold even low-privilege access to shared Langflow instances.

Sources: NVD IBM Support ATLAS

What is the risk?

Medium severity per NVD (CVSS 6.5) but the confidentiality-only impact profile (C:H/I:N/A:N) understates the operational risk in an AI framework context, since the files exposed can include secrets that unlock much higher-impact follow-on attacks (stolen LLM API keys, database credentials, other tenants' pipeline configs). Likelihood of exploitation is currently low-to-moderate: no EPSS score is available, it is absent from CISA KEV and VulnCheck KEV, and no public PoC or scanner signature has surfaced, but the low attack complexity and modest privilege bar (any authenticated account) mean the barrier to exploitation is low once details circulate. Exposure hinges heavily on deployment model — internet-facing, multi-user Langflow instances (shared SaaS-style deployments, internal AI platform teams with many onboarded users) carry materially more risk than single-user or air-gapped installs.

How does the attack unfold?

Initial Access

Attacker obtains or registers a low-privilege authenticated account on a shared Langflow instance.

AML.T0012

Exploitation

Attacker abuses the improper access control flaw to request files outside their authorized scope.

AML.T0037

Collection

Attacker reads sensitive host files such as .env configs, other users' flow definitions, or embedded credentials.

AML.T0055

Impact

Stolen LLM API keys or database credentials are used to exfiltrate data, run up costs, or pivot to connected systems.

AML.T0025

Initial Access

Attacker obtains or registers a low-privilege authenticated account on a shared Langflow instance.

AML.T0012

Exploitation

Attacker abuses the improper access control flaw to request files outside their authorized scope.

AML.T0037

Collection

Attacker reads sensitive host files such as .env configs, other users' flow definitions, or embedded credentials.

AML.T0055

Impact

Stolen LLM API keys or database credentials are used to exfiltrate data, run up costs, or pivot to connected systems.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
154.7K Pushed 7d ago 17% patched ~70d to patch Full package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 23% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I None

A None

What should I do?

1 step

1) Upgrade Langflow to the first version released after 1.11.5 per IBM's advisory (https://www.ibm.com/support/pages/node/7286657) as soon as it is validated in a staging environment. 2) Until patched, avoid provisioning low-privilege/guest accounts on shared or internet-facing Langflow instances, and review existing account rosters for accounts that shouldn't have access. 3) Rotate any secrets (LLM API keys, DB credentials) that were stored in files reachable by the Langflow process, since you cannot retroactively confirm they weren't read pre-patch. 4) Restrict network exposure of Langflow admin/API surfaces to trusted networks or VPN, and enable audit logging on authentication and file-access-adjacent endpoints to detect anomalous read patterns from low-privilege accounts. 5) Track IBM's advisory page for the specific patched version number once published.

How is it classified?

Auth Bypass Data Leakage Framework Agent AML.T0007 - Discover AI Artifacts AML.T0037 - Data from Local System AML.T0055 - Unsecured Credentials

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

Annex A.9 - Data for AI systems

NIST AI RMF

MEASURE 2.7 - AI system security and resilience are evaluated and documented

OWASP LLM Top 10

LLM02:2025 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-79725?

IBM Langflow OSS versions 1.0.0 through 1.11.5 contain an improper access control flaw (CWE-284) that lets a remote, already-authenticated user read arbitrary files on the host, with no user interaction required and low attack complexity. Confidentiality impact is rated high while integrity and availability are unaffected, and IBM has not published an EPSS score, the flaw is not in CISA KEV, and no public exploit code or Nuclei template exists today — so this is not an emergency, but Langflow is widely used to build and orchestrate LLM agent workflows, meaning a compromised low-privilege account could pull environment variables, provider API keys, or other users' flow definitions off the host. Because exploitation only requires a valid low-privilege login (PR:L) and no special conditions, any multi-tenant or shared Langflow deployment should treat this as a near-term patch priority rather than a background item. Upgrade to the IBM-supplied fixed release above 1.11.5 immediately, and in the interim tighten account provisioning and audit which users hold even low-privilege access to shared Langflow instances.

Is CVE-2026-79725 actively exploited?

No confirmed active exploitation of CVE-2026-79725 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-79725?

1) Upgrade Langflow to the first version released after 1.11.5 per IBM's advisory (https://www.ibm.com/support/pages/node/7286657) as soon as it is validated in a staging environment. 2) Until patched, avoid provisioning low-privilege/guest accounts on shared or internet-facing Langflow instances, and review existing account rosters for accounts that shouldn't have access. 3) Rotate any secrets (LLM API keys, DB credentials) that were stored in files reachable by the Langflow process, since you cannot retroactively confirm they weren't read pre-patch. 4) Restrict network exposure of Langflow admin/API surfaces to trusted networks or VPN, and enable audit logging on authentication and file-access-adjacent endpoints to detect anomalous read patterns from low-privilege accounts. 5) Track IBM's advisory page for the specific patched version number once published.

What systems are affected by CVE-2026-79725?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines, LLM orchestration platforms.

What is the CVSS score for CVE-2026-79725?

CVE-2026-79725 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.30%.

What is the AI security impact?

Affected AI Architectures

agent frameworksRAG pipelinesLLM orchestration platforms

MITRE ATLAS Techniques

AML.T0007 Discover AI Artifacts

AML.T0037 Data from Local System

AML.T0055 Unsecured Credentials

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: Annex A.9

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM02:2025

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to read arbitrary files due to improper access control.

Exploitation Scenario

An attacker signs up for or otherwise obtains a low-privilege authenticated account on a shared, internet-facing Langflow instance (common in teams that let multiple engineers or business users build flows on one deployment). Using that account, they send a crafted request that exploits the improper access control logic to read files outside their authorized scope — targeting the server's .env file, application config, or another tenant's saved flow JSON. From those files they extract LLM provider API keys and any database or vector-store credentials embedded in the configuration, then use the stolen keys to run up API costs, exfiltrate data from connected RAG data sources, or pivot into other systems that trust those credentials.

Weaknesses (CWE)

CWE-284 Improper Access Control Primary CWE-284 Improper Access Control

CWE-284 — Improper Access Control: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

[Architecture and Design, Operation] Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
[Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

Source: MITRE CWE corpus.