CVE-2026-81204: Langflow unauthenticated RCE

CISO Take

IBM Langflow, an open-source low-code builder for AI agents and LLM workflows, contains a code injection flaw (CWE-94) in how it constructs flow graphs, letting a remote, unauthenticated attacker execute arbitrary code on the host with no user interaction required. This rates critical (CVSS 9.8, AV:N/AC:L/PR:N/UI:N) with full compromise of confidentiality, integrity, and availability — there is no EPSS score or CISA KEV listing yet and no known public exploit or scanner template, so real-world exploitation telemetry is not yet available, but the near-zero attack complexity and lack of any authentication requirement mean a working exploit is trivial to weaponize once details circulate. Langflow instances are frequently deployed with embedded credentials for LLM APIs, vector databases, and other backend integrations, so RCE on the host is rarely contained to the flow-builder itself. Patch to a version beyond 1.11.5 immediately; if patching is delayed, take Langflow instances off the public internet, front them with authentication at the network layer, and monitor for unexpected process spawning or outbound connections from Langflow hosts as a compensating detection.

Sources: NVD ATLAS

What is the risk?

Critical risk. The vulnerability requires no privileges and no user interaction, has low attack complexity, and is remotely reachable over the network — the textbook profile for rapid mass exploitation once a public PoC appears. There is currently no EPSS score, no CISA KEV entry, and no known public exploit or Nuclei template, so exploitation-in-the-wild cannot be confirmed at this time; however, the absence of exploitation telemetry should not be read as low risk given the CVSS 9.8 severity and the trivial exploitability profile. Organizations running internet-facing or otherwise network-reachable Langflow instances should treat this as an emergency patch, not a routine one.

How does the attack unfold?

Initial Access

Attacker reaches Langflow's flow/graph-construction API over the network without needing credentials.

AML.T0049

Code Injection

A crafted graph/component definition is submitted and evaluated during graph construction, injecting attacker-controlled code.

AML.T0050

Impact

The injected code executes on the Langflow host, giving the attacker full remote code execution and access to any credentials or connected systems the instance can reach.

Initial Access

Attacker reaches Langflow's flow/graph-construction API over the network without needing credentials.

AML.T0049

Code Injection

A crafted graph/component definition is submitted and evaluated during graph construction, injecting attacker-controlled code.

AML.T0050

Impact

The injected code executes on the Langflow host, giving the attacker full remote code execution and access to any credentials or connected systems the instance can reach.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
154.7K Pushed 7d ago 17% patched ~70d to patch Full package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

0.6%

chance of exploitation in 30 days

Higher than 47% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C High

I High

A High

What should I do?

1 step

Upgrade IBM Langflow OSS to a fixed release beyond 1.11.5 immediately. Until patched, do not expose Langflow's graph-build/API endpoints directly to the internet — place them behind a VPN, reverse-proxy authentication, or IP allowlist. Rotate any credentials (LLM API keys, vector DB, database) accessible from the Langflow host as a precaution if the instance has been internet-facing. Enable/verify logging on Langflow's flow-construction API and monitor for anomalous process execution, unexpected outbound connections, or unusual flow-definition payloads on affected hosts. Track vendor advisories and NVD for a published fix version and apply it as part of emergency change management given the 9.8 severity.

What does CISA's SSVC say?

Decision Track*

Exploitation none

Automatable Yes

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Supply Chain Framework Agent AML.T0049 - Exploit Public-Facing Application AML.T0050 - Command and Scripting Interpreter

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.4 - AI system operation and security

NIST AI RMF

MEASURE 2.7 - AI system security and resilience are evaluated and documented

OWASP LLM Top 10

LLM03:2025 - Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2026-81204?

IBM Langflow, an open-source low-code builder for AI agents and LLM workflows, contains a code injection flaw (CWE-94) in how it constructs flow graphs, letting a remote, unauthenticated attacker execute arbitrary code on the host with no user interaction required. This rates critical (CVSS 9.8, AV:N/AC:L/PR:N/UI:N) with full compromise of confidentiality, integrity, and availability — there is no EPSS score or CISA KEV listing yet and no known public exploit or scanner template, so real-world exploitation telemetry is not yet available, but the near-zero attack complexity and lack of any authentication requirement mean a working exploit is trivial to weaponize once details circulate. Langflow instances are frequently deployed with embedded credentials for LLM APIs, vector databases, and other backend integrations, so RCE on the host is rarely contained to the flow-builder itself. Patch to a version beyond 1.11.5 immediately; if patching is delayed, take Langflow instances off the public internet, front them with authentication at the network layer, and monitor for unexpected process spawning or outbound connections from Langflow hosts as a compensating detection.

Is CVE-2026-81204 actively exploited?

No confirmed active exploitation of CVE-2026-81204 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-81204?

Upgrade IBM Langflow OSS to a fixed release beyond 1.11.5 immediately. Until patched, do not expose Langflow's graph-build/API endpoints directly to the internet — place them behind a VPN, reverse-proxy authentication, or IP allowlist. Rotate any credentials (LLM API keys, vector DB, database) accessible from the Langflow host as a precaution if the instance has been internet-facing. Enable/verify logging on Langflow's flow-construction API and monitor for anomalous process execution, unexpected outbound connections, or unusual flow-definition payloads on affected hosts. Track vendor advisories and NVD for a published fix version and apply it as part of emergency change management given the 9.8 severity.

What systems are affected by CVE-2026-81204?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, LLM orchestration / low-code workflow builders, RAG pipelines.

What is the CVSS score for CVE-2026-81204?

CVE-2026-81204 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 0.60%.

What is the AI security impact?

Affected AI Architectures

agent frameworksLLM orchestration / low-code workflow buildersRAG pipelines

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0050 Command and Scripting Interpreter

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.4

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM03:2025

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to execute arbitrary code due to code injection during graph construction.

Exploitation Scenario

An attacker scans for internet-exposed Langflow instances (a common low-code AI agent/workflow platform) and submits a crafted flow/graph definition to the flow-construction endpoint without authenticating. The malicious component payload is evaluated during graph construction, triggering code injection and giving the attacker a shell on the Langflow host. From there, the attacker harvests LLM API keys and any credentials configured for connected tools, databases, or vector stores, then pivots to those downstream systems or exfiltrates the data and secrets directly.

Weaknesses (CWE)

CWE-94 Improper Control of Generation of Code ('Code Injection') Primary CWE-94 Improper Control of Generation of Code ('Code Injection')

CWE-94 — Improper Control of Generation of Code ('Code Injection'): The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

[Architecture and Design] Refactor your program so that you do not have to dynamically generate code.
[Architecture and Design] Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.