CVE-2026-9196: Langflow RCE — HIGH

CISO Take

Langflow's Agentic Assistant validates AI-generated components by actually running the model's Python code on the backend before a human ever approves it, so any authenticated user — even one with low privileges — can trigger arbitrary code execution with the privileges of the Langflow backend process, enabling outbound network access, file system interaction, or data exfiltration. CVSS 8.8 reflects low attack complexity and no user interaction beyond holding a session, which matters because Langflow is a widely deployed low-code framework for building LLM agents and RAG pipelines, often exposed to less-trusted internal builders. It is not in CISA KEV, no public exploit or scanner template exists yet, and CISA's SSVC decision is TRACK — the EPSS score of 0.00265 is low in absolute terms even though it ranks in the 81st percentile relative to other CVEs, so this reads as a real risk to remediate on a normal patch cycle rather than an active-exploitation emergency. Because the flaw sits in a pre-approval validation step, it defeats the human-in-the-loop control that Agentic Assistant is supposed to provide, which is the core CISO concern here. Restrict who can submit components for Agentic Assistant validation, apply IBM's fix once published for versions above 1.10.3, and monitor the Langflow backend process for unexpected outbound connections or file writes during validation workflows.

Sources: NVD EPSS ATLAS CISA SSVC ibm.com

What is the risk?

High severity (CVSS 8.8) driven by full confidentiality, integrity, and availability impact combined with network attack vector and low complexity — an attacker only needs a low-privileged authenticated account (PR:L) and no user interaction (UI:N) to trigger arbitrary code execution. Exploitability today is bounded: no public exploit code, no Nuclei scanner template, and the CVE is absent from CISA KEV. CISA's own SSVC decision is TRACK (monitor, patch on normal cycle, not emergency). EPSS's raw probability (0.266%) is low in absolute terms; the 81st-percentile ranking only means it's more likely than most CVEs, not that exploitation is imminent. The real risk driver is architectural: the vulnerability defeats the intended human-approval gate for AI-generated code, which is precisely the control CISOs rely on to keep agentic AI tooling safe. Any org running multi-tenant or self-service Langflow deployments where less-trusted users can build agent flows should treat this as a priority patch, even without active exploitation signals.

How does the attack unfold?

Authenticated Access

Attacker obtains or already holds a low-privileged authenticated account on the Langflow instance, satisfying the PR:L requirement.

AML.T0012

Malicious Component Crafting

Attacker crafts or manipulates an Agentic Assistant prompt so the LLM generates a Python component embedding a malicious payload.

AML.T0102

Pre-Approval Code Execution

Submitting the component for 'validation' causes Langflow's backend to execute the LLM-generated code immediately, before any human approval.

AML.T0050

Impact

The payload runs with the Langflow backend process's privileges, enabling outbound network access, filesystem interaction, or data exfiltration.

AML.T0025

Authenticated Access

Attacker obtains or already holds a low-privileged authenticated account on the Langflow instance, satisfying the PR:L requirement.

AML.T0012

Malicious Component Crafting

Attacker crafts or manipulates an Agentic Assistant prompt so the LLM generates a Python component embedding a malicious payload.

AML.T0102

Pre-Approval Code Execution

Submitting the component for 'validation' causes Langflow's backend to execute the LLM-generated code immediately, before any human approval.

AML.T0050

Impact

The payload runs with the Langflow backend process's privileges, enabling outbound network access, filesystem interaction, or data exfiltration.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
155.0K Pushed 2d ago 17% patched ~70d to patch Full package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 23% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I High

A High

What should I do?

1 step

1) Patch: track IBM's advisory (linked reference) for a fixed Langflow release above 1.10.3 and apply as soon as available. 2) Access control: restrict who can invoke Agentic Assistant component validation to trusted/admin roles via RBAC until patched — treat 'authenticated' as insufficient trust for this feature. 3) Isolation: run the Langflow backend in a sandboxed, least-privilege container with no direct access to production secrets, internal APIs, or broad network egress, so that code executed during validation has limited blast radius. 4) Detection: monitor the Langflow backend host/process for anomalous child processes, unexpected outbound network connections, or unexpected file writes coinciding with component validation events; alert on egress from the Langflow host to unfamiliar destinations. 5) Interim workaround: disable or gate the Agentic Assistant validation feature entirely if it isn't business-critical until the fix is deployed.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution Data Leakage Framework Agent AML.T0012 - Valid Accounts AML.T0050 - Command and Scripting Interpreter AML.T0102 - Generate Malicious Commands

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

NIST AI RMF

MEASURE 2.7 - AI system security and resilience is evaluated and documented

OWASP LLM Top 10

LLM05:2025 - Improper Output Handling LLM08:2025 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-9196?

Langflow's Agentic Assistant validates AI-generated components by actually running the model's Python code on the backend before a human ever approves it, so any authenticated user — even one with low privileges — can trigger arbitrary code execution with the privileges of the Langflow backend process, enabling outbound network access, file system interaction, or data exfiltration. CVSS 8.8 reflects low attack complexity and no user interaction beyond holding a session, which matters because Langflow is a widely deployed low-code framework for building LLM agents and RAG pipelines, often exposed to less-trusted internal builders. It is not in CISA KEV, no public exploit or scanner template exists yet, and CISA's SSVC decision is TRACK — the EPSS score of 0.00265 is low in absolute terms even though it ranks in the 81st percentile relative to other CVEs, so this reads as a real risk to remediate on a normal patch cycle rather than an active-exploitation emergency. Because the flaw sits in a pre-approval validation step, it defeats the human-in-the-loop control that Agentic Assistant is supposed to provide, which is the core CISO concern here. Restrict who can submit components for Agentic Assistant validation, apply IBM's fix once published for versions above 1.10.3, and monitor the Langflow backend process for unexpected outbound connections or file writes during validation workflows.

Is CVE-2026-9196 actively exploited?

No confirmed active exploitation of CVE-2026-9196 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-9196?

1) Patch: track IBM's advisory (linked reference) for a fixed Langflow release above 1.10.3 and apply as soon as available. 2) Access control: restrict who can invoke Agentic Assistant component validation to trusted/admin roles via RBAC until patched — treat 'authenticated' as insufficient trust for this feature. 3) Isolation: run the Langflow backend in a sandboxed, least-privilege container with no direct access to production secrets, internal APIs, or broad network egress, so that code executed during validation has limited blast radius. 4) Detection: monitor the Langflow backend host/process for anomalous child processes, unexpected outbound network connections, or unexpected file writes coinciding with component validation events; alert on egress from the Langflow host to unfamiliar destinations. 5) Interim workaround: disable or gate the Agentic Assistant validation feature entirely if it isn't business-critical until the fix is deployed.

What systems are affected by CVE-2026-9196?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines.

What is the CVSS score for CVE-2026-9196?

CVE-2026-9196 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.30%.

What is the AI security impact?

Affected AI Architectures

agent frameworksRAG pipelines

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0050 Command and Scripting Interpreter

AML.T0102 Generate Malicious Commands

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM05:2025, LLM08:2025

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute unintended code during Agentic Assistant validation due to improper handling of LLM‑generated components. The application executes model‑generated Python code in the backend during validation prior to user approval, which may allow an attacker to trigger side effects such as outbound network access, file system interaction, or data exfiltration with the privileges of the Langflow backend process.

Exploitation Scenario

An attacker holding a low-privileged, authenticated Langflow account (e.g., a contractor or business user with a 'builder' role rather than admin) creates or edits a flow using the Agentic Assistant, prompting or manipulating it so the LLM generates a Python component embedding a malicious payload — for example, code that reads environment variables and secrets, opens a reverse shell, or issues an outbound HTTP request to an attacker-controlled endpoint. When the attacker submits this AI-generated component for 'validation' (a step meant to preview/test the code before human approval), Langflow's backend executes it immediately and automatically. The payload runs with the full privileges of the Langflow backend process — no admin rights or additional user interaction required — giving the attacker access to credentials, internal network reachability, or a path to exfiltrate data, all before any human ever reviewed or approved the generated code.

Weaknesses (CWE)

CWE-94 Improper Control of Generation of Code ('Code Injection') Primary CWE-94 Improper Control of Generation of Code ('Code Injection')

CWE-94 — Improper Control of Generation of Code ('Code Injection'): The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

[Architecture and Design] Refactor your program so that you do not have to dynamically generate code.
[Architecture and Design] Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.