CVE-2026-8478: Langflow RCE — HIGH

CISO Take

IBM Langflow versions 1.0.0 through 1.10.3 fail to properly control user-supplied code, letting an authenticated low-privilege user inject and execute arbitrary code on the host running the platform. This matters because Langflow is a visual builder for LangChain-based agent and RAG workflows, so a compromised instance exposes every credential, data source, and downstream integration wired into those pipelines — the CVSS 8.8 score reflects full confidentiality, integrity, and availability impact over the network with no user interaction required. Actual exploitation pressure is currently low: EPSS sits at 0.37%, there's no public exploit or Nuclei template, the CVE isn't in CISA KEV, and CISA's SSVC decision is TRACK rather than Act — but the low privilege bar (PR:L, e.g. any non-admin collaborator account) combined with total system impact means this shouldn't sit in a patch backlog. Upgrade past 1.10.3 on any internet- or network-reachable Langflow deployment now, and in the meantime restrict who can hold non-admin accounts and audit custom-code components for unexpected execution paths.

Sources: NVD EPSS ATLAS ibm.com

What is the risk?

High severity (CVSS 8.8) driven by network attack vector, low complexity, and complete C/I/A impact, tempered by the requirement for low-level authenticated access (PR:L) and currently low real-world exploitation signal (EPSS 0.37%, no KEV listing, no public PoC/exploit, no Nuclei template, SSVC = TRACK). This profile is typical of a serious-but-not-yet-weaponized flaw: exploitability is technically straightforward for anyone who already holds a low-privilege Langflow account, but the authentication requirement meaningfully reduces the population of opportunistic attackers versus a fully unauthenticated RCE. Risk rises sharply for any Langflow instance that is internet-facing, has open/self-service account registration, or shares credentials/infrastructure with production AI pipelines.

How does the attack unfold?

Initial Access

Attacker obtains or already holds a low-privilege Langflow user account on a network-reachable instance.

AML.T0049

Exploitation

Attacker submits crafted input to an unsanitized custom code field, triggering the CWE-94 code injection flaw.

AML.T0050

Execution

Injected code runs with the Langflow backend's privileges, giving the attacker a foothold on the host server.

Impact

Attacker harvests embedded credentials/API keys and connected data sources, or tampers with production agent workflows, achieving full compromise of confidentiality, integrity, and availability.

AML.T0025

Initial Access

Attacker obtains or already holds a low-privilege Langflow user account on a network-reachable instance.

AML.T0049

Exploitation

Attacker submits crafted input to an unsanitized custom code field, triggering the CWE-94 code injection flaw.

AML.T0050

Execution

Injected code runs with the Langflow backend's privileges, giving the attacker a foothold on the host server.

Impact

Attacker harvests embedded credentials/API keys and connected data sources, or tampers with production agent workflows, achieving full compromise of confidentiality, integrity, and availability.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
155.0K Pushed 2d ago 17% patched ~70d to patch Full package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 32% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I High

A High

What should I do?

1 step

Patch: upgrade all Langflow OSS deployments to a version newer than 1.10.3 as soon as IBM publishes/confirms the fixed release. Workaround: until patched, restrict Langflow account provisioning so only trusted, need-to-know users hold any account (since exploitation requires only low privileges), disable public self-registration if enabled, and avoid exposing the Langflow UI directly to the internet — place it behind VPN or a reverse proxy with additional authentication. Detection: monitor Langflow application and host-level logs for anomalous process spawns or shell activity originating from the Langflow service account, review custom-code/component definitions for unexpected or obfuscated code, and audit recently created or modified low-privilege accounts for suspicious activity.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Framework Agent AML.T0049 - Exploit Public-Facing Application AML.T0050 - Command and Scripting Interpreter

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6 - AI system security

NIST AI RMF

MEASURE 2.7 - AI system security and resilience is evaluated and documented

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-8478?

IBM Langflow versions 1.0.0 through 1.10.3 fail to properly control user-supplied code, letting an authenticated low-privilege user inject and execute arbitrary code on the host running the platform. This matters because Langflow is a visual builder for LangChain-based agent and RAG workflows, so a compromised instance exposes every credential, data source, and downstream integration wired into those pipelines — the CVSS 8.8 score reflects full confidentiality, integrity, and availability impact over the network with no user interaction required. Actual exploitation pressure is currently low: EPSS sits at 0.37%, there's no public exploit or Nuclei template, the CVE isn't in CISA KEV, and CISA's SSVC decision is TRACK rather than Act — but the low privilege bar (PR:L, e.g. any non-admin collaborator account) combined with total system impact means this shouldn't sit in a patch backlog. Upgrade past 1.10.3 on any internet- or network-reachable Langflow deployment now, and in the meantime restrict who can hold non-admin accounts and audit custom-code components for unexpected execution paths.

Is CVE-2026-8478 actively exploited?

No confirmed active exploitation of CVE-2026-8478 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-8478?

Patch: upgrade all Langflow OSS deployments to a version newer than 1.10.3 as soon as IBM publishes/confirms the fixed release. Workaround: until patched, restrict Langflow account provisioning so only trusted, need-to-know users hold any account (since exploitation requires only low privileges), disable public self-registration if enabled, and avoid exposing the Langflow UI directly to the internet — place it behind VPN or a reverse proxy with additional authentication. Detection: monitor Langflow application and host-level logs for anomalous process spawns or shell activity originating from the Langflow service account, review custom-code/component definitions for unexpected or obfuscated code, and audit recently created or modified low-privilege accounts for suspicious activity.

What systems are affected by CVE-2026-8478?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, LLM orchestration pipelines, low-code/no-code AI workflow builders, RAG pipelines.

What is the CVSS score for CVE-2026-8478?

CVE-2026-8478 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.38%.

What is the AI security impact?

Affected AI Architectures

agent frameworksLLM orchestration pipelineslow-code/no-code AI workflow buildersRAG pipelines

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0050 Command and Scripting Interpreter

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote attacker to inject arbitrary code on the system, due to the improper control of user input code.

Exploitation Scenario

An attacker obtains or is granted a low-privilege Langflow account (e.g., a collaborator invited to a shared workspace, or a compromised low-tier credential from a phishing/credential-stuffing campaign). Using that account, they submit crafted input into a custom code component or code-execution field that Langflow fails to properly sanitize, causing the platform backend to execute attacker-controlled code. From there the attacker pivots off the Langflow server itself — harvesting embedded LLM/vector-DB API keys, reading connected data sources, and tampering with or exfiltrating the agent workflows running in production.

Weaknesses (CWE)

CWE-94 Improper Control of Generation of Code ('Code Injection') Primary CWE-94 Improper Control of Generation of Code ('Code Injection')

CWE-94 — Improper Control of Generation of Code ('Code Injection'): The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

[Architecture and Design] Refactor your program so that you do not have to dynamically generate code.
[Architecture and Design] Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.