CVE-2026-93447: Langflow: unsafe cache deserialization allows code execution

HIGH

Published October 7, 2026

CISO Take

Langflow OSS 1.0.0 through 1.12.2 deserializes cached values from Redis without safe handling (CWE-502). An attacker who holds the server secret and can write to Redis can plant a malicious serialized object that runs code with the service process's privileges when it is read. The prerequisites are demanding: high attack complexity, plus two separate footholds (the secret and Redis write access). EPSS is low at 0.00429 (about the 65th percentile). The CVE is not in CISA KEV, and there is no public exploit or Nuclei template. It is therefore a priority for deployments with shared or exposed Redis, not an emergency. Upgrade to the fixed release in IBM's advisory (https://www.ibm.com/support/pages/node/7290694), rotate the Langflow secret, and restrict Redis access to the Langflow service only.

Sources:NVDEPSSibm.comATLAS

What is the risk?

The CVSS 7.5 (High) rating reflects full confidentiality, integrity and availability impact, offset by high attack complexity and low required privileges. Exploitation needs the server secret and Redis write access, so the realistic risk comes from chained compromises: leaked secrets, an unauthenticated or network-exposed Redis, or a malicious insider or lateral-movement actor. Real-world likelihood is low (EPSS 0.00429, no KEV listing, no public PoC). The impact if it succeeds is full code execution on the host that runs the AI workflow builder, and that host usually holds LLM API keys, vector database credentials and connector secrets. Package risk data is unavailable (N/A), so exposure should be assessed from your own inventory.

How does the attack unfold?

Initial Access

Attacker obtains the Langflow server secret and write access to the Redis cache used by the service.

AML.T0055

Payload Planting

Attacker writes a malicious serialized object into a cache key that Langflow reads.

Exploitation

Langflow retrieves and deserializes the poisoned value, executing attacker code with service privileges.

AML.T0050

Impact

Attacker steals LLM and vector database credentials, tampers with flows and pivots into connected systems.

AML.T0112

Initial Access

Attacker obtains the Langflow server secret and write access to the Redis cache used by the service.

AML.T0055

Payload Planting

Attacker writes a malicious serialized object into a cache key that Langflow reads.

Exploitation

Langflow retrieves and deserializes the poisoned value, executing attacker code with service privileges.

AML.T0050

Impact

Attacker steals LLM and vector database credentials, tampers with flows and pivots into connected systems.

AML.T0112

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
156.0KPushed 6d ago18% patched~66d to patchFull package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 21% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Advanced

What is the attack surface?

AVNetwork

ACHigh

PRLow

UINone

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade Langflow OSS to the fixed version listed in the IBM advisory (https://www.ibm.com/support/pages/node/7290694); versions 1.0.0 through 1.12.2 are affected. 2) Rotate the Langflow secret key and any credentials stored in flows if compromise is suspected. 3) Restrict Redis to private networks, require authentication and TLS, and use ACLs so only the Langflow service can write cache keys. 4) Do not reuse a Redis instance across trust boundaries. 5) Detect: monitor Redis for unexpected writes to Langflow cache keys, alert on child processes spawned by the Langflow service, and review egress traffic from Langflow hosts.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code ExecutionSupply ChainFrameworkAgentAML.T0050- Command and Scripting Interpreter AML.T0055- Unsecured Credentials AML.T0112- Machine Compromise

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Respond to and recover from previously unknown risks

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-93447?

Is CVE-2026-93447 actively exploited?

No confirmed active exploitation of CVE-2026-93447 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-93447?

1) Upgrade Langflow OSS to the fixed version listed in the IBM advisory (https://www.ibm.com/support/pages/node/7290694); versions 1.0.0 through 1.12.2 are affected. 2) Rotate the Langflow secret key and any credentials stored in flows if compromise is suspected. 3) Restrict Redis to private networks, require authentication and TLS, and use ACLs so only the Langflow service can write cache keys. 4) Do not reuse a Redis instance across trust boundaries. 5) Detect: monitor Redis for unexpected writes to Langflow cache keys, alert on child processes spawned by the Langflow service, and review egress traffic from Langflow hosts.

What systems are affected by CVE-2026-93447?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, LLM workflow orchestration, RAG pipelines, low-code AI builders.

What is the CVSS score for CVE-2026-93447?

CVE-2026-93447 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.29%.

What is the AI security impact?

Affected AI Architectures

agent frameworksLLM workflow orchestrationRAG pipelineslow-code AI builders

MITRE ATLAS Techniques

AML.T0050Command and Scripting Interpreter

AML.T0055Unsecured Credentials

AML.T0112Machine Compromise

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.12.2 could allow an attacker with access to the server secret and Redis write access to submit a malicious serialized cache value. When the value was retrieved, deserialization could have executed attacker-controlled code with the privileges of the service process.

Exploitation Scenario

An attacker gains access to a shared internal Redis instance, for example through a misconfigured or exposed port or a compromised neighboring service, and obtains the Langflow secret from a leaked environment file or repository. They write a crafted serialized payload under a cache key Langflow reads. When a flow run or component next retrieves that entry, deserialization runs the attacker's code as the Langflow service user. The attacker then harvests LLM API keys and vector database credentials, modifies flows to exfiltrate data, and moves laterally into connected systems.

Weaknesses (CWE)

CWE-502Deserialization of Untrusted DataPrimary CWE-502Deserialization of Untrusted Data

CWE-502 — Deserialization of Untrusted Data: The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

[Architecture and Design, Implementation] If available, use the signing/sealing features of the programming language to assure that deserialized data has not been tainted. For example, a hash-based message authentication code (HMAC) could be used to ensure that data has not been modified.
[Implementation] When deserializing data, populate a new object rather than just deserializing. The result is that the data flows through safe input validation and that the functions are safe.

Source: MITRE CWE corpus.