CVE-2026-8182: Langflow pre-auth RCE

CISO Take

IBM Langflow OSS versions 1.0.0 through 1.10.3 contain a code injection flaw (CWE-94) that lets an attacker execute arbitrary code on the server using just two HTTP requests, with IBM's advisory describing it as requiring no credentials despite the CVSS vector listing PR:L. Langflow is a widely adopted low-code builder for LLM and agent workflows, so any internet-exposed instance — including ones spun up quickly for internal RAG or agent prototyping — hands over full server compromise to anyone who can reach it, with confidentiality, integrity, and availability all rated High in the resulting 8.8 CVSS score. Exploitation isn't confirmed active yet: EPSS puts real-world exploitation probability at just 0.38% (top 68th percentile of scored CVEs), the CVE is absent from CISA's KEV catalog, CISA's SSVC decision is TRACK rather than Act, and no public exploit or Nuclei template exists. Still, Langflow has a track record of critical unauthenticated RCEs with working Metasploit modules, so this reads as a race against a PoC being published rather than a low-priority finding. Patch to a release beyond 1.10.3 immediately, and until then pull any internet-facing Langflow instance behind a VPN or IAP and monitor egress for reverse-shell activity.

Sources: NVD EPSS CISA KEV ibm.com

What is the risk?

High risk despite the low EPSS score. The combination of network attack vector, low attack complexity, no user interaction, and (per IBM's own description) no credentials required means the practical barrier to exploitation is minimal — an attacker only needs network reachability to the Langflow instance and knowledge of the two-request exploit chain. The gap between the 8.8 CVSS severity and the 0.38% EPSS/TRACK SSVC status reflects that no PoC is public yet, not that the vulnerability is hard to weaponize once one surfaces. Given Langflow's history of critical pre-auth RCEs with public exploit tooling, this should be treated as high-priority patching work, not deferred as low-likelihood.

How does the attack unfold?

Initial Access

Attacker identifies an internet-exposed Langflow instance and sends an unauthenticated HTTP request to stage a malicious code path.

AML.T0049

Code Execution

A second unauthenticated HTTP request triggers execution of the injected code on the Langflow server (CWE-94).

AML.T0050

Impact

Attacker gains full server compromise, harvesting LLM/API/vector-DB credentials and pivoting into connected AI pipeline infrastructure.

AML.T0072

Initial Access

Attacker identifies an internet-exposed Langflow instance and sends an unauthenticated HTTP request to stage a malicious code path.

AML.T0049

Code Execution

A second unauthenticated HTTP request triggers execution of the injected code on the Langflow server (CWE-94).

AML.T0050

Impact

Attacker gains full server compromise, harvesting LLM/API/vector-DB credentials and pivoting into connected AI pipeline infrastructure.

AML.T0072

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
155.0K Pushed 2d ago 17% patched ~70d to patch Full package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 32% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I High

A High

What should I do?

1 step

1) Patch Langflow to a version newer than 1.10.3 as soon as it is available — check IBM's advisory (https://www.ibm.com/support/pages/node/7282646) for the fixed release. 2) Until patched, do not expose Langflow directly to the internet — place it behind a VPN, identity-aware proxy, or at minimum a reverse proxy enforcing authentication. 3) Audit current deployments for internet exposure (Shodan/Censys-style scan of your own IP ranges for Langflow's default port/banner). 4) Rotate any credentials (LLM API keys, vector DB tokens, tool secrets) stored in or accessible from Langflow instances that were internet-facing. 5) Monitor for anomalous outbound connections or process spawning from Langflow hosts (reverse shells, unexpected child processes) as a detection signal, since no Nuclei template exists yet for automated scanning-based detection.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Auth Bypass Framework Agent AML.T0049 - Exploit Public-Facing Application AML.T0050 - Command and Scripting Interpreter AML.T0072 - Reverse Shell

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6 - AI system deployment and operation

NIST AI RMF

MEASURE 2.7 - AI system security and resilience are evaluated and documented

OWASP LLM Top 10

LLM03:2025 - Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2026-8182?

IBM Langflow OSS versions 1.0.0 through 1.10.3 contain a code injection flaw (CWE-94) that lets an attacker execute arbitrary code on the server using just two HTTP requests, with IBM's advisory describing it as requiring no credentials despite the CVSS vector listing PR:L. Langflow is a widely adopted low-code builder for LLM and agent workflows, so any internet-exposed instance — including ones spun up quickly for internal RAG or agent prototyping — hands over full server compromise to anyone who can reach it, with confidentiality, integrity, and availability all rated High in the resulting 8.8 CVSS score. Exploitation isn't confirmed active yet: EPSS puts real-world exploitation probability at just 0.38% (top 68th percentile of scored CVEs), the CVE is absent from CISA's KEV catalog, CISA's SSVC decision is TRACK rather than Act, and no public exploit or Nuclei template exists. Still, Langflow has a track record of critical unauthenticated RCEs with working Metasploit modules, so this reads as a race against a PoC being published rather than a low-priority finding. Patch to a release beyond 1.10.3 immediately, and until then pull any internet-facing Langflow instance behind a VPN or IAP and monitor egress for reverse-shell activity.

Is CVE-2026-8182 actively exploited?

No confirmed active exploitation of CVE-2026-8182 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-8182?

1) Patch Langflow to a version newer than 1.10.3 as soon as it is available — check IBM's advisory (https://www.ibm.com/support/pages/node/7282646) for the fixed release. 2) Until patched, do not expose Langflow directly to the internet — place it behind a VPN, identity-aware proxy, or at minimum a reverse proxy enforcing authentication. 3) Audit current deployments for internet exposure (Shodan/Censys-style scan of your own IP ranges for Langflow's default port/banner). 4) Rotate any credentials (LLM API keys, vector DB tokens, tool secrets) stored in or accessible from Langflow instances that were internet-facing. 5) Monitor for anomalous outbound connections or process spawning from Langflow hosts (reverse shells, unexpected child processes) as a detection signal, since no Nuclei template exists yet for automated scanning-based detection.

What systems are affected by CVE-2026-8182?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines, LLM orchestration pipelines.

What is the CVSS score for CVE-2026-8182?

CVE-2026-8182 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.38%.

What is the AI security impact?

Affected AI Architectures

agent frameworksRAG pipelinesLLM orchestration pipelines

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0050 Command and Scripting Interpreter

AML.T0072 Reverse Shell

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM03:2025

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.10.3 installations allow anyone on the internet to execute arbitrary code on the server without any credentials via 2 HTTP requests.

Exploitation Scenario

An attacker scans the internet for exposed Langflow instances (a common misconfiguration for teams prototyping AI agent workflows). Finding one, they send a first HTTP request to a vulnerable endpoint to stage or configure a malicious code path — for example, creating or modifying a custom component/flow that embeds attacker-controlled code — then send a second request that triggers execution of that code on the server, all without authenticating. Once code executes, the attacker harvests any LLM API keys, vector database credentials, or internal network access available to the Langflow process, and pivots deeper into the AI stack or the broader internal network from there.

Weaknesses (CWE)

CWE-94 Improper Control of Generation of Code ('Code Injection') Primary CWE-94 Improper Control of Generation of Code ('Code Injection')

CWE-94 — Improper Control of Generation of Code ('Code Injection'): The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

[Architecture and Design] Refactor your program so that you do not have to dynamically generate code.
[Architecture and Design] Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.