CVE-2026-93449: Langflow: code injection allows authenticated RCE

HIGH

Published October 7, 2026

CISO Take

IBM Langflow OSS versions 1.0.0 through 1.12.2 contain a code-generation flaw (CWE-94) that lets an authenticated remote attacker execute arbitrary code on the server. The CVSS score is 8.5 with a changed scope, so a compromise can reach beyond the Langflow process, but the attack needs a low-privilege account and high complexity. EPSS is 0.58% (top 54%), the CVE is not in CISA KEV, and there is no public exploit or Nuclei template, so mass exploitation is not expected right away. Langflow has a large history of vulnerabilities (194 other CVEs in this package), and a Langflow host often holds LLM API keys and database credentials, so compromise has real consequences. Check the IBM advisory (ibm.com/support/pages/node/7290694) for the fixed version, upgrade any instance running 1.12.2 or earlier, and restrict who can create or edit flows until the upgrade is done.

Sources:NVDEPSSATLASibm.com

What is the risk?

Moderate-to-high. Impact is full confidentiality, integrity and availability loss (C:H/I:H/A:H) with scope change. Exploitability is limited by the need for authentication (PR:L) and high attack complexity (AC:H). EPSS of 0.00582 (top 54%) shows below-average near-term exploitation likelihood. There is no KEV listing, no public exploit and no scanner template. The risk rises sharply for internet-exposed Langflow instances, multi-user deployments, and instances where low-privilege users can create or edit flows or components.

How does the attack unfold?

Initial Access

Attacker obtains or uses a low-privilege authenticated account on a reachable Langflow instance.

AML.T0012

Exploitation

Attacker submits crafted input that reaches the code-generation logic unchecked, resulting in arbitrary code execution on the server.

AML.T0049

Credential Access

Attacker reads stored LLM API keys, database credentials and environment secrets from the Langflow host.

AML.T0050

Impact

Attacker pivots to connected data stores and cloud resources and tampers with flows, with full confidentiality, integrity and availability impact.

Initial Access

Attacker obtains or uses a low-privilege authenticated account on a reachable Langflow instance.

AML.T0012

Exploitation

Attacker submits crafted input that reaches the code-generation logic unchecked, resulting in arbitrary code execution on the server.

AML.T0049

Credential Access

Attacker reads stored LLM API keys, database credentials and environment secrets from the Langflow host.

AML.T0050

Impact

Attacker pivots to connected data stores and cloud resources and tampers with flows, with full confidentiality, integrity and availability impact.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
156.0KPushed 6d ago18% patched~66d to patchFull package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 35% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Check the IBM advisory (ibm.com/support/pages/node/7290694) for the fixed release and upgrade all Langflow instances running 1.0.0 through 1.12.2. 2) Until patched, remove public internet exposure, put Langflow behind a VPN or authenticated reverse proxy, and limit accounts that can create or edit flows and custom components. 3) Run Langflow as a non-root user in a container with minimal network egress and no access to production credentials beyond what flows need. 4) Rotate LLM API keys, database credentials, and other secrets stored in Langflow if compromise is suspected. 5) Detect: monitor for unexpected child processes spawned by the Langflow process, unusual outbound connections, and flow or component edits by low-privilege users. 6) Inventory Langflow deployments, including developer and prototype instances.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code ExecutionFrameworkAgentAML.T0012- Valid Accounts AML.T0049- Exploit Public-Facing Application AML.T0050- Command and Scripting Interpreter

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.10.3-Suppliers

NIST AI RMF

GOVERN 6.1-Policies and procedures for third-party AI risks

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-93449?

Is CVE-2026-93449 actively exploited?

No confirmed active exploitation of CVE-2026-93449 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-93449?

1) Check the IBM advisory (ibm.com/support/pages/node/7290694) for the fixed release and upgrade all Langflow instances running 1.0.0 through 1.12.2. 2) Until patched, remove public internet exposure, put Langflow behind a VPN or authenticated reverse proxy, and limit accounts that can create or edit flows and custom components. 3) Run Langflow as a non-root user in a container with minimal network egress and no access to production credentials beyond what flows need. 4) Rotate LLM API keys, database credentials, and other secrets stored in Langflow if compromise is suspected. 5) Detect: monitor for unexpected child processes spawned by the Langflow process, unusual outbound connections, and flow or component edits by low-privilege users. 6) Inventory Langflow deployments, including developer and prototype instances.

What systems are affected by CVE-2026-93449?

This vulnerability affects the following AI/ML architecture patterns: LLM application builders, agent frameworks, RAG pipelines, workflow orchestration.

What is the CVSS score for CVE-2026-93449?

CVE-2026-93449 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.41%.

What is the AI security impact?

Affected AI Architectures

LLM application buildersagent frameworksRAG pipelinesworkflow orchestration

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0049Exploit Public-Facing Application

AML.T0050Command and Scripting Interpreter

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.10.3

NIST AI RMF: GOVERN 6.1

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code generation.

Exploitation Scenario

An attacker obtains a low-privilege Langflow account, for example through a shared team workspace, credential reuse, or open self-registration. They submit a crafted flow or component definition whose input reaches the server-side code-generation logic without proper control, so attacker-supplied code runs on the Langflow host. From there they read environment variables and stored credentials (LLM API keys, vector database credentials), then use them to access data stores and cloud resources, or pivot to other internal systems. They may also alter existing flows to persist or to manipulate AI application outputs.

Weaknesses (CWE)

CWE-94Improper Control of Generation of Code ('Code Injection')Primary CWE-94Improper Control of Generation of Code ('Code Injection')

CWE-94 — Improper Control of Generation of Code ('Code Injection'): The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

[Architecture and Design] Refactor your program so that you do not have to dynamically generate code.
[Architecture and Design] Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.