CVE-2026-88962: Langflow: authenticated code injection allows RCE

HIGH

Published October 7, 2026

CISO Take

IBM Langflow OSS 1.0.0 through 1.12.2 contains a code-generation flaw (CWE-94) that lets any authenticated user run arbitrary code on the server, with a CVSS of 8.8 (network, low complexity, low privileges, no user interaction). Current exploitation signals are modest: EPSS is 0.00789 (top 45%), the CVE is not in CISA KEV, and there is no public exploit or Nuclei template. Even so, Langflow servers usually hold LLM API keys, vector database credentials and connector secrets, so one compromised low-privilege account can become a full pivot point. Prior code-injection flaws in Langflow have been exploited in the wild, so this class deserves attention despite the low EPSS. Apply the fixed release listed in the IBM advisory (https://www.ibm.com/support/pages/node/7290694), restrict who can create or edit flows, and keep instances off the public internet until patched.

Sources:NVDEPSSibm.comATLAS

What is the risk?

Risk is HIGH, not critical. Impact is complete (C:H/I:H/A:H) and the attack needs no user interaction and has low complexity. The authentication requirement (PR:L) lowers real-world exposure, but Langflow often allows open registration, shared accounts or leaked tokens, and that weakens the barrier. Exploitation likelihood is currently low to moderate (EPSS 0.00789, no KEV, no public PoC, no scanner template). Confidence: MEDIUM, because the advisory gives few technical details, no fixed version appears in the data we hold, and no dependents or Scorecard data are available.

How does the attack unfold?

Initial Access

Attacker authenticates to a reachable Langflow instance with a low-privilege account obtained through open signup, phishing or leaked credentials.

AML.T0012

Exploitation

Attacker submits crafted input or a custom component that the platform converts into executable code, triggering arbitrary code execution on the server.

AML.T0049

Execution & Credential Access

Attacker runs commands on the host and harvests LLM API keys, vector DB credentials and connector secrets.

AML.T0050

Impact

Attacker pivots into internal systems, exfiltrates pipeline data or tampers with production flows, causing loss of confidentiality, integrity and availability.

Initial Access

Attacker authenticates to a reachable Langflow instance with a low-privilege account obtained through open signup, phishing or leaked credentials.

AML.T0012

Exploitation

Attacker submits crafted input or a custom component that the platform converts into executable code, triggering arbitrary code execution on the server.

AML.T0049

Execution & Credential Access

Attacker runs commands on the host and harvests LLM API keys, vector DB credentials and connector secrets.

AML.T0050

Impact

Attacker pivots into internal systems, exfiltrates pipeline data or tampers with production flows, causing loss of confidentiality, integrity and availability.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
156.0KPushed 6d ago18% patched~66d to patchFull package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.7%

chance of exploitation in 30 days

Higher than 52% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade Langflow OSS to the fixed version named in the IBM advisory (https://www.ibm.com/support/pages/node/7290694); versions 1.0.0 through 1.12.2 are affected. 2) Until patched, put Langflow behind a VPN or SSO-protected reverse proxy, disable open self-registration, and remove unused or shared accounts. 3) Run the service as a non-root user in a container with minimal network egress, read-only filesystem where possible, and no cloud-admin credentials. 4) Rotate LLM, vector DB and connector secrets stored on instances that were exposed. 5) Detect: alert on unexpected child processes spawned by the Langflow process, outbound connections from the host to unfamiliar destinations, and flow or component creation or edits by unusual users; review application logs for code-component changes since 2026-10-07.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code ExecutionFrameworkAgentAML.T0012- Valid Accounts AML.T0049- Exploit Public-Facing Application AML.T0050- Command and Scripting Interpreter

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responses to previously unknown risks and mechanisms for deactivation

OWASP LLM Top 10

LLM03-Supply ChainLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-88962?

Is CVE-2026-88962 actively exploited?

No confirmed active exploitation of CVE-2026-88962 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-88962?

1) Upgrade Langflow OSS to the fixed version named in the IBM advisory (https://www.ibm.com/support/pages/node/7290694); versions 1.0.0 through 1.12.2 are affected. 2) Until patched, put Langflow behind a VPN or SSO-protected reverse proxy, disable open self-registration, and remove unused or shared accounts. 3) Run the service as a non-root user in a container with minimal network egress, read-only filesystem where possible, and no cloud-admin credentials. 4) Rotate LLM, vector DB and connector secrets stored on instances that were exposed. 5) Detect: alert on unexpected child processes spawned by the Langflow process, outbound connections from the host to unfamiliar destinations, and flow or component creation or edits by unusual users; review application logs for code-component changes since 2026-10-07.

What systems are affected by CVE-2026-88962?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines, LLM orchestration platforms, visual workflow builders.

What is the CVSS score for CVE-2026-88962?

CVE-2026-88962 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.68%.

What is the AI security impact?

Affected AI Architectures

agent frameworksRAG pipelinesLLM orchestration platformsvisual workflow builders

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0049Exploit Public-Facing Application

AML.T0050Command and Scripting Interpreter

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03, LLM06

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code generation.

Exploitation Scenario

An attacker obtains low-privilege Langflow credentials through open registration, a phished user or a leaked token. They create or edit a flow or custom component and submit crafted input that the platform turns into executable code, which runs on the server. They then read environment variables and stored credentials for OpenAI-style APIs and vector databases, and establish a reverse shell. From there they pivot to internal data stores, siphon data passing through RAG pipelines, or quietly modify production flows to persist and manipulate agent outputs.

Weaknesses (CWE)

CWE-94Improper Control of Generation of Code ('Code Injection')Primary CWE-94Improper Control of Generation of Code ('Code Injection')

CWE-94 — Improper Control of Generation of Code ('Code Injection'): The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

[Architecture and Design] Refactor your program so that you do not have to dynamically generate code.
[Architecture and Design] Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.