CVE-2026-84889: Langflow authenticated path traversal

CISO Take

Langflow, the popular open-source visual builder for LLM and agent workflows, has a path traversal flaw (CWE-22) that lets any low-privilege authenticated user escape a restricted directory and achieve arbitrary code execution on the host — an 8.8-severity, network-exploitable bug requiring no user interaction. This matters because Langflow instances are frequently stood up quickly for prototyping and often carry embedded API keys for LLM providers, vector databases, and downstream tools, so compromising even a low-tier account can translate directly into full host takeover and lateral movement into connected AI infrastructure. There's no evidence yet of a public exploit, Nuclei template, or CISA KEV listing, and EPSS data isn't available, so this isn't a mass-exploited bug today, but the low attack complexity and the ubiquity of self-hosted Langflow deployments in internal AI tooling make it an attractive target once a PoC surfaces. Security teams running Langflow OSS should patch beyond version 1.10.3 immediately and audit which accounts hold even low-privilege roles, since that's all an attacker needs to trigger this. Until patched, restrict Langflow access to VPN/internal-only networks and monitor for anomalous file-system access or unexpected process spawns from the Langflow service account.

Sources: NVD ATLAS ibm.com

What is the risk?

High risk despite the absence of a known public exploit or KEV listing. The CVSS 8.8 score reflects a network-reachable, low-complexity path traversal that requires only low privileges and no user interaction to reach full confidentiality/integrity/availability impact via arbitrary code execution. The main mitigating factor is the authentication requirement (PR:L) — this is not pre-auth RCE — but Langflow instances are often deployed with permissive self-registration or shared low-privilege accounts for prototyping teams, which meaningfully lowers the real-world bar to obtaining that first foothold. No EPSS percentile, exploit code, or scanner template is currently available, so near-term opportunistic exploitation is unlikely, but that can change quickly once a PoC circulates given how well-understood path traversal-to-RCE chains are.

How does the attack unfold?

Initial Access

Attacker obtains or is granted a low-privilege authenticated account on a Langflow instance.

AML.T0012

Exploitation

Attacker submits a crafted request exploiting the path traversal (CWE-22) to escape the restricted directory.

AML.T0049

Code Execution

The traversal allows writing/executing a file outside the sandboxed path, achieving arbitrary code execution under the Langflow service account.

AML.T0050

Impact

Attacker harvests LLM provider keys and connected service credentials from Langflow flows and pivots into downstream AI infrastructure.

Initial Access

Attacker obtains or is granted a low-privilege authenticated account on a Langflow instance.

AML.T0012

Exploitation

Attacker submits a crafted request exploiting the path traversal (CWE-22) to escape the restricted directory.

AML.T0049

Code Execution

The traversal allows writing/executing a file outside the sandboxed path, achieving arbitrary code execution under the Langflow service account.

AML.T0050

Impact

Attacker harvests LLM provider keys and connected service credentials from Langflow flows and pivots into downstream AI infrastructure.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
154.7K Pushed 7d ago 17% patched ~70d to patch Full package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.5%

chance of exploitation in 30 days

Higher than 44% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I High

A High

What should I do?

1 step

Upgrade Langflow OSS beyond version 1.10.3 as soon as a fixed release is available and confirmed. Until patched, restrict network access to Langflow instances to trusted internal networks or VPN — do not expose the UI/API directly to the internet. Review and minimize accounts with even low-privilege access, since PR:L is the only barrier to exploitation; disable open self-registration if enabled. Rotate any API keys or credentials stored in or accessible to Langflow flows as a precaution. Monitor Langflow service logs and host-level file-integrity/process-creation telemetry for anomalous file paths outside expected component/flow directories and unexpected child processes spawned by the Langflow service account.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Framework Agent AML.T0012 - Valid Accounts AML.T0049 - Exploit Public-Facing Application AML.T0050 - Command and Scripting Interpreter

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6 - AI system security controls

NIST AI RMF

MANAGE-2.3 - AI system risk response and recovery

Frequently Asked Questions

What is CVE-2026-84889?

Langflow, the popular open-source visual builder for LLM and agent workflows, has a path traversal flaw (CWE-22) that lets any low-privilege authenticated user escape a restricted directory and achieve arbitrary code execution on the host — an 8.8-severity, network-exploitable bug requiring no user interaction. This matters because Langflow instances are frequently stood up quickly for prototyping and often carry embedded API keys for LLM providers, vector databases, and downstream tools, so compromising even a low-tier account can translate directly into full host takeover and lateral movement into connected AI infrastructure. There's no evidence yet of a public exploit, Nuclei template, or CISA KEV listing, and EPSS data isn't available, so this isn't a mass-exploited bug today, but the low attack complexity and the ubiquity of self-hosted Langflow deployments in internal AI tooling make it an attractive target once a PoC surfaces. Security teams running Langflow OSS should patch beyond version 1.10.3 immediately and audit which accounts hold even low-privilege roles, since that's all an attacker needs to trigger this. Until patched, restrict Langflow access to VPN/internal-only networks and monitor for anomalous file-system access or unexpected process spawns from the Langflow service account.

Is CVE-2026-84889 actively exploited?

No confirmed active exploitation of CVE-2026-84889 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-84889?

Upgrade Langflow OSS beyond version 1.10.3 as soon as a fixed release is available and confirmed. Until patched, restrict network access to Langflow instances to trusted internal networks or VPN — do not expose the UI/API directly to the internet. Review and minimize accounts with even low-privilege access, since PR:L is the only barrier to exploitation; disable open self-registration if enabled. Rotate any API keys or credentials stored in or accessible to Langflow flows as a precaution. Monitor Langflow service logs and host-level file-integrity/process-creation telemetry for anomalous file paths outside expected component/flow directories and unexpected child processes spawned by the Langflow service account.

What systems are affected by CVE-2026-84889?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, AI orchestration pipelines, model serving.

What is the CVSS score for CVE-2026-84889?

CVE-2026-84889 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.54%.

What is the AI security impact?

Affected AI Architectures

agent frameworksAI orchestration pipelinesmodel serving

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0049 Exploit Public-Facing Application

AML.T0050 Command and Scripting Interpreter

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE-2.3

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to improper limitation of a pathname to a restricted directory.

Exploitation Scenario

An attacker obtains or is granted a low-privilege Langflow account — for example via an open self-signup flow, a shared prototyping credential, or a phished internal user. Using that authenticated session, they submit a crafted request (e.g., a component or file-reference path containing traversal sequences) that escapes the restricted directory Langflow expects file operations to be confined to. This allows them to write or overwrite a file outside the sandboxed path — such as a script or configuration loaded during flow execution — which Langflow then executes with its own process privileges, yielding arbitrary code execution on the host. From there, the attacker harvests LLM provider keys and connected service credentials configured in Langflow flows and pivots into downstream AI infrastructure.

Weaknesses (CWE)

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Primary CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.