CVE-2026-81211: Langflow broken authz on components

CISO Take

IBM Langflow OSS versions 1.0.0 through 1.11.5 contain a missing-authorization flaw (CWE-862) that lets a remote, authenticated low-privilege user execute arbitrary Python code through custom components embedded in stored flows. This matters because Langflow is a widely used low-code builder for LLM agents and RAG pipelines, so any tenant, collaborator, or low-tier account on a shared instance can pivot straight to full code execution on the host running the flow engine — no user interaction required and attack complexity is low (CVSS 8.8, AV:N/AC:L/PR:L). There is no EPSS score yet, it is not in CISA KEV, and no public exploit or Nuclei template has surfaced, but Langflow has a track record of actively exploited RCEs (e.g. CVE-2025-3248), so treat this as a fast-follow risk rather than a low-priority patch. Upgrade to a fixed Langflow release beyond 1.11.5 immediately, and in the interim restrict flow-sharing/multi-tenant access so only trusted, fully-trusted admin accounts can create or execute custom components. Monitor Langflow server logs for unexpected Python execution or child-process spawning tied to component invocation as a detection signal until patched.

Sources: NVD ATLAS

What is the risk?

High severity (CVSS 8.8) with low attack complexity and no user interaction, but requiring low-privilege authentication caps the blast radius to instances that allow multi-user or multi-tenant access (shared internal deployments, managed Langflow SaaS, or team accounts). Exploitability is currently theoretical — no known public exploit code, no Nuclei template, not in CISA KEV, and EPSS is unavailable — but the vulnerability class (authorization bypass leading directly to code execution) is straightforward to weaponize once details circulate, and Langflow's history of exploited RCEs raises the likelihood this gets picked up quickly. Impact if exploited is severe: full arbitrary Python execution in the context of the Langflow server process, which typically has access to LLM API keys, vector database credentials, and any connected internal systems configured in flows.

How does the attack unfold?

Initial Access

Attacker obtains or uses a low-privileged authenticated account on a shared/multi-tenant Langflow instance.

AML.T0012

Exploitation

Attacker invokes a custom component in a stored flow without proper authorization checks, triggering arbitrary Python code execution.

AML.T0050

Impact

Arbitrary code runs with the Langflow server's privileges, exposing LLM API keys, vector DB credentials, and enabling lateral movement to connected systems.

Initial Access

Attacker obtains or uses a low-privileged authenticated account on a shared/multi-tenant Langflow instance.

AML.T0012

Exploitation

Attacker invokes a custom component in a stored flow without proper authorization checks, triggering arbitrary Python code execution.

AML.T0050

Impact

Arbitrary code runs with the Langflow server's privileges, exposing LLM API keys, vector DB credentials, and enabling lateral movement to connected systems.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
154.7K Pushed 7d ago 17% patched ~70d to patch Full package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 28% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I High

A High

What should I do?

1 step

Patch to the fixed Langflow release above 1.11.5 as soon as IBM/Langflow publishes it (track the vendor advisory at ibm.com/support/pages/node/7286666). Until patched: restrict Langflow instances to single-tenant or fully-trusted-user deployments, disable or tightly gate custom component creation/execution to admin-only roles, and avoid exposing multi-user Langflow instances directly to low-trust or external accounts. Audit existing stored flows for custom components created or modified by non-admin accounts. For detection, monitor the Langflow server host for anomalous Python subprocess execution, unexpected outbound connections, or file writes originating from the flow-execution service, and review authentication/authorization logs for privilege-inconsistent component-execution requests.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Auth Bypass Framework Agent Plugin AML.T0012 - Valid Accounts AML.T0049 - Exploit Public-Facing Application AML.T0050 - Command and Scripting Interpreter

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2 - AI system operation and monitoring

NIST AI RMF

MEASURE 2.7 - AI system security and resilience is evaluated and documented

OWASP LLM Top 10

LLM07 - Insecure Plugin Design

Frequently Asked Questions

What is CVE-2026-81211?

IBM Langflow OSS versions 1.0.0 through 1.11.5 contain a missing-authorization flaw (CWE-862) that lets a remote, authenticated low-privilege user execute arbitrary Python code through custom components embedded in stored flows. This matters because Langflow is a widely used low-code builder for LLM agents and RAG pipelines, so any tenant, collaborator, or low-tier account on a shared instance can pivot straight to full code execution on the host running the flow engine — no user interaction required and attack complexity is low (CVSS 8.8, AV:N/AC:L/PR:L). There is no EPSS score yet, it is not in CISA KEV, and no public exploit or Nuclei template has surfaced, but Langflow has a track record of actively exploited RCEs (e.g. CVE-2025-3248), so treat this as a fast-follow risk rather than a low-priority patch. Upgrade to a fixed Langflow release beyond 1.11.5 immediately, and in the interim restrict flow-sharing/multi-tenant access so only trusted, fully-trusted admin accounts can create or execute custom components. Monitor Langflow server logs for unexpected Python execution or child-process spawning tied to component invocation as a detection signal until patched.

Is CVE-2026-81211 actively exploited?

No confirmed active exploitation of CVE-2026-81211 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-81211?

Patch to the fixed Langflow release above 1.11.5 as soon as IBM/Langflow publishes it (track the vendor advisory at ibm.com/support/pages/node/7286666). Until patched: restrict Langflow instances to single-tenant or fully-trusted-user deployments, disable or tightly gate custom component creation/execution to admin-only roles, and avoid exposing multi-user Langflow instances directly to low-trust or external accounts. Audit existing stored flows for custom components created or modified by non-admin accounts. For detection, monitor the Langflow server host for anomalous Python subprocess execution, unexpected outbound connections, or file writes originating from the flow-execution service, and review authentication/authorization logs for privilege-inconsistent component-execution requests.

What systems are affected by CVE-2026-81211?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines.

What is the CVSS score for CVE-2026-81211?

CVE-2026-81211 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.34%.

What is the AI security impact?

Affected AI Architectures

agent frameworksRAG pipelines

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0049 Exploit Public-Facing Application

AML.T0050 Command and Scripting Interpreter

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM07

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary Python code due to improper authorization of custom components in stored flows.

Exploitation Scenario

An attacker registers or obtains a low-privileged authenticated account on a shared Langflow instance (e.g., a client, contractor, or junior team member account with view/edit-limited permissions). They craft or modify a stored flow to include a malicious custom component containing arbitrary Python code, then invoke execution of that component. Because Langflow fails to properly authorize the action against the user's actual permission level, the code runs on the Langflow server with the service's privileges — granting the attacker a foothold to read environment variables (LLM API keys, database credentials), pivot to connected vector databases or internal APIs, or establish persistence on the host.

Weaknesses (CWE)

CWE-862 Missing Authorization Primary CWE-862 Missing Authorization

CWE-862 — Missing Authorization: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.