CVE-2026-93443: Langflow: code injection allows authenticated RCE

HIGH

Published October 7, 2026

CISO Take

IBM Langflow OSS versions 1.0.0 through 1.12.2 contain a code injection flaw (CWE-94) that lets an authenticated remote attacker execute arbitrary code on the host. Urgency is moderate rather than critical: the CVSS is 7.5 because exploitation needs low privileges and high attack complexity, EPSS is only 0.58% (around the 54th percentile), the CVE is not in CISA KEV, and there is no public exploit or Nuclei template. Even so, Langflow servers typically hold LLM API keys, vector DB credentials and connector secrets, and past Langflow RCEs have drawn quick attacker attention, so code execution here means a likely compromise of those secrets. Upgrade to the fixed release listed in the IBM advisory (https://www.ibm.com/support/pages/node/7290694). Until you can, restrict Langflow to trusted networks, review which accounts hold valid credentials, and monitor for unexpected child processes spawned by the Langflow service.

Sources:NVDEPSSibm.comATLAS

What is the risk?

Medium-high. Impact is full confidentiality, integrity and availability loss (C:H/I:H/A:H) on the Langflow host. Exploitation likelihood is currently low to moderate: it requires a valid account (PR:L) and high attack complexity, EPSS is 0.00582, and there is no KEV listing, public PoC or scanner template. Risk rises sharply for internet-exposed instances, deployments with open self-registration or shared or weak credentials, and hosts holding production secrets. Lacking dependent-count and scorecard data, blast radius cannot be quantified (Sin datos).

How does the attack unfold?

Initial Access

Attacker authenticates to an exposed Langflow instance using low-privilege credentials.

AML.T0012

Exploitation

Attacker submits input containing unneutralized code that the server evaluates, triggering CWE-94 code injection.

AML.T0049

Execution

Injected code runs with the Langflow service's privileges, giving the attacker arbitrary command execution.

AML.T0050

Impact

Attacker steals LLM and vector DB credentials, tampers with flows, and pivots into connected systems.

AML.T0055

Initial Access

Attacker authenticates to an exposed Langflow instance using low-privilege credentials.

AML.T0012

Exploitation

Attacker submits input containing unneutralized code that the server evaluates, triggering CWE-94 code injection.

AML.T0049

Execution

Injected code runs with the Langflow service's privileges, giving the attacker arbitrary command execution.

AML.T0050

Impact

Attacker steals LLM and vector DB credentials, tampers with flows, and pivots into connected systems.

AML.T0055

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
156.0KPushed 6d ago18% patched~66d to patchFull package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 35% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade Langflow OSS beyond 1.12.2 to the fixed version named in the IBM advisory (https://www.ibm.com/support/pages/node/7290694). 2) If you cannot patch immediately, remove public exposure and place Langflow behind a VPN or an authenticating reverse proxy. 3) Disable open sign-up, enforce strong unique credentials and MFA at the proxy, and audit existing user accounts. 4) Run Langflow in a container as a non-root user with minimal egress and no host mounts. 5) Rotate API keys and secrets stored in or reachable from Langflow if compromise is suspected. 6) Detection: alert on shell or interpreter processes spawned by the Langflow process, unusual outbound connections, and unexpected changes to flows or component code in audit logs.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code ExecutionFrameworkAgentAML.T0012- Valid Accounts AML.T0049- Exploit Public-Facing Application AML.T0050- Command and Scripting Interpreter AML.T0055- Unsecured Credentials

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Response to previously unknown risks and mechanisms for deactivating AI systems

OWASP LLM Top 10

LLM03-Supply ChainLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-93443?

Is CVE-2026-93443 actively exploited?

No confirmed active exploitation of CVE-2026-93443 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-93443?

1) Upgrade Langflow OSS beyond 1.12.2 to the fixed version named in the IBM advisory (https://www.ibm.com/support/pages/node/7290694). 2) If you cannot patch immediately, remove public exposure and place Langflow behind a VPN or an authenticating reverse proxy. 3) Disable open sign-up, enforce strong unique credentials and MFA at the proxy, and audit existing user accounts. 4) Run Langflow in a container as a non-root user with minimal egress and no host mounts. 5) Rotate API keys and secrets stored in or reachable from Langflow if compromise is suspected. 6) Detection: alert on shell or interpreter processes spawned by the Langflow process, unusual outbound connections, and unexpected changes to flows or component code in audit logs.

What systems are affected by CVE-2026-93443?

This vulnerability affects the following AI/ML architecture patterns: Agent frameworks, RAG pipelines, LLM workflow orchestration, Low-code AI application builders.

What is the CVSS score for CVE-2026-93443?

CVE-2026-93443 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.40%.

What is the AI security impact?

Affected AI Architectures

Agent frameworksRAG pipelinesLLM workflow orchestrationLow-code AI application builders

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0049Exploit Public-Facing Application

AML.T0050Command and Scripting Interpreter

AML.T0055Unsecured Credentials

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03, LLM06

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in code.

Exploitation Scenario

An attacker obtains low-privilege credentials, for example through open registration, credential reuse or a phished user, on an exposed Langflow instance. They craft input, such as a custom component or a flow parameter, containing code that is not properly neutralized and is evaluated server-side. The injected code runs with the Langflow service's privileges, letting the attacker read environment variables and stored LLM and vector DB keys, install a reverse shell, and pivot to connected data sources, or modify flows to manipulate downstream AI outputs.

Weaknesses (CWE)

CWE-94Improper Control of Generation of Code ('Code Injection')Primary CWE-94Improper Control of Generation of Code ('Code Injection')

CWE-94 — Improper Control of Generation of Code ('Code Injection'): The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

[Architecture and Design] Refactor your program so that you do not have to dynamically generate code.
[Architecture and Design] Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.