CVE-2026-93445: Langflow: code injection allows authenticated RCE

HIGH

Published October 7, 2026

CISO Take

CVE-2026-93445 is an improper code generation control flaw (CWE-94) in IBM Langflow OSS 1.0.0 through 1.12.2 that lets any authenticated user execute arbitrary code on the host over the network, with low complexity and no user interaction. The CVSS score is 8.1 (high), and the EPSS of 0.0061 (about the top 52th percentile) points to moderate rather than imminent exploitation. It is not in CISA KEV, and we found no public exploit or Nuclei template. Still, Langflow has a record of exploitable code-execution bugs (194 other CVEs tracked against this package), and its hosts usually hold LLM API keys, vector database credentials and connector secrets, so a single low-privilege account can become a full compromise. Upgrade to the fixed release listed in the IBM advisory (https://www.ibm.com/support/pages/node/7290694). Until then, restrict Langflow to trusted users and networks, and review who holds accounts, including self-registered ones.

Sources:NVDEPSSATLASibm.com

What is the risk?

Risk is HIGH but not critical. The attack is network-reachable, low complexity and needs no user interaction, but it requires valid low-privilege credentials, which cuts the likely attacker pool. Impact is high for confidentiality and integrity (C:H/I:H) and none for availability. Exploitation likelihood is moderate (EPSS 0.0061, about the top 52%), with no KEV listing, public exploit or scanner template at publication. The package risk score of 77/100 and 194 historical CVEs show that Langflow is a repeat target. Exposure rises sharply where Langflow is internet-facing, where self-signup is on, or where credentials are shared across many users.

How does the attack unfold?

Initial Access

The attacker authenticates to the Langflow instance with a low-privilege account obtained by credential theft or open registration.

AML.T0012

Exploitation

The attacker sends crafted input that triggers improper code generation, causing the server to run attacker-controlled code.

AML.T0049

Execution

Arbitrary commands run on the host under the Langflow service account, and a reverse shell can be established.

AML.T0050

Impact

The attacker steals LLM API keys and RAG data, tampers with flows, and pivots to connected cloud and data services.

AML.T0055

Initial Access

The attacker authenticates to the Langflow instance with a low-privilege account obtained by credential theft or open registration.

AML.T0012

Exploitation

The attacker sends crafted input that triggers improper code generation, causing the server to run attacker-controlled code.

AML.T0049

Execution

Arbitrary commands run on the host under the Langflow service account, and a reverse shell can be established.

AML.T0050

Impact

The attacker steals LLM API keys and RAG data, tampers with flows, and pivots to connected cloud and data services.

AML.T0055

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
156.0KPushed 6d ago18% patched~66d to patchFull package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 38% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade Langflow OSS to the fixed version named in IBM's advisory (https://www.ibm.com/support/pages/node/7290694); the vulnerable range is 1.0.0 through 1.12.2. 2) Until patched, do not expose Langflow to the internet; place it behind a VPN or an authenticating reverse proxy and disable open self-registration. 3) Audit user accounts and API tokens, remove unused ones, and enforce strong authentication. 4) Run Langflow as an unprivileged user in a container with a read-only filesystem, no host mounts and egress filtering. 5) Rotate LLM API keys, database credentials and other secrets stored on or reachable from affected hosts if compromise is suspected. 6) Detect: monitor for unexpected child processes spawned by the Langflow process, outbound connections to unfamiliar hosts, and creation or modification of flows or custom components by unusual accounts.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code ExecutionFrameworkPluginAML.T0012- Valid Accounts AML.T0049- Exploit Public-Facing Application AML.T0050- Command and Scripting Interpreter AML.T0055- Unsecured Credentials

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.10.3-Suppliers

NIST AI RMF

MANAGE 2.3-Response to unknown risks and component failures

OWASP LLM Top 10

LLM03-Supply ChainLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-93445?

Is CVE-2026-93445 actively exploited?

No confirmed active exploitation of CVE-2026-93445 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-93445?

1) Upgrade Langflow OSS to the fixed version named in IBM's advisory (https://www.ibm.com/support/pages/node/7290694); the vulnerable range is 1.0.0 through 1.12.2. 2) Until patched, do not expose Langflow to the internet; place it behind a VPN or an authenticating reverse proxy and disable open self-registration. 3) Audit user accounts and API tokens, remove unused ones, and enforce strong authentication. 4) Run Langflow as an unprivileged user in a container with a read-only filesystem, no host mounts and egress filtering. 5) Rotate LLM API keys, database credentials and other secrets stored on or reachable from affected hosts if compromise is suspected. 6) Detect: monitor for unexpected child processes spawned by the Langflow process, outbound connections to unfamiliar hosts, and creation or modification of flows or custom components by unusual accounts.

What systems are affected by CVE-2026-93445?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, LLM orchestration platforms, RAG pipelines, low-code AI workflow builders.

What is the CVSS score for CVE-2026-93445?

CVE-2026-93445 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.44%.

What is the AI security impact?

Affected AI Architectures

agent frameworksLLM orchestration platformsRAG pipelineslow-code AI workflow builders

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0049Exploit Public-Facing Application

AML.T0050Command and Scripting Interpreter

AML.T0055Unsecured Credentials

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.10.3

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03, LLM06

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code.

Exploitation Scenario

An attacker obtains a low-privilege Langflow account, for example through credential stuffing, an open sign-up, or a phished developer login. They submit crafted input, such as a custom component or flow definition, that causes the server to generate and execute attacker-controlled code. The code runs on the Langflow host, where the attacker reads environment variables and configuration to steal LLM API keys and vector database credentials, then opens a reverse shell for persistence. From there they exfiltrate RAG data, tamper with production flows, and move laterally into cloud services.

Weaknesses (CWE)

CWE-94Improper Control of Generation of Code ('Code Injection')Primary CWE-94Improper Control of Generation of Code ('Code Injection')

CWE-94 — Improper Control of Generation of Code ('Code Injection'): The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

[Architecture and Design] Refactor your program so that you do not have to dynamically generate code.
[Architecture and Design] Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.