CVE-2026-93674: Langflow: OS command injection allows remote RCE

CRITICALPoC AVAILABLENUCLEI TEMPLATECISA: TRACK*

Published October 7, 2026

CISO Take

CVE-2026-93674 is an unauthenticated OS command injection (CWE-94) in IBM Langflow OSS 1.0.0 through 1.12.2 that lets a remote attacker run arbitrary code with no privileges and no user interaction (CVSS 9.8). Langflow is the visual orchestrator for LLM agents and RAG flows, so a compromised instance typically exposes LLM provider API keys, vector database credentials and connected enterprise data. Today the exploitation signals are modest: EPSS is 0.00756 (top 46%), the CVE is not in CISA KEV, and there is no public exploit or Nuclei template. Even so, Langflow has a history of rapid weaponization of this bug class, so the low score should not buy much patience. Upgrade to the fixed release listed in the IBM advisory (https://www.ibm.com/support/pages/node/7290694), take any internet-exposed Langflow instance off the public network, and rotate the secrets stored in the platform if exposure cannot be ruled out.

Sources:NVDEPSSibm.comATLAS

What is the risk?

High to critical. The attack is network-reachable, low complexity, needs no privileges and no user interaction, and impacts confidentiality, integrity and availability fully (CVSS 9.8). Short-term exploitation likelihood is moderate to low (EPSS 0.76%, no public PoC, not in KEV), but that can change quickly once the patch is diffed. Exposure depends on whether Langflow is reachable from the internet or untrusted networks. Instances deployed with default or no authentication, or as shared prototyping servers, carry the highest risk. Package context data is limited (no dependents or Scorecard data), so blast radius is estimated from the role Langflow plays in AI stacks.

How does the attack unfold?

Initial Access

Attacker finds an exposed Langflow instance and sends a crafted request to the vulnerable endpoint without authentication.

AML.T0049

Execution

Injected special elements are passed to an OS command, giving arbitrary code execution on the server.

AML.T0050

Credential Access

Attacker harvests LLM API keys, vector DB credentials and tokens from the environment and flow store.

AML.T0055

Impact

Attacker tampers with flows, exfiltrates data, pivots into internal networks and abuses LLM resources.

AML.T0048

Initial Access

Attacker finds an exposed Langflow instance and sends a crafted request to the vulnerable endpoint without authentication.

AML.T0049

Execution

Injected special elements are passed to an OS command, giving arbitrary code execution on the server.

AML.T0050

Credential Access

Attacker harvests LLM API keys, vector DB credentials and tokens from the environment and flow store.

AML.T0055

Impact

Attacker tampers with flows, exfiltrates data, pivots into internal networks and abuses LLM resources.

AML.T0048

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
156.0KPushed 6d ago18% patched~66d to patchFull package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

15.3%

chance of exploitation in 30 days

Higher than 97% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

✓Weaponized Metasploit module (exploit/multi/http/langflow_auth_command_injection_cve_2026_93674)

○Nuclei detection template available

○EPSS exploit prediction: 15%

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade Langflow OSS to the fixed version specified in the IBM advisory (https://www.ibm.com/support/pages/node/7290694). 2) Inventory all Langflow instances (including dev, shadow-IT and containerized ones) and identify versions 1.0.0 to 1.12.2. 3) Until patched, restrict network access with a VPN, IP allowlist or authenticating reverse proxy, and do not expose the service to the internet. 4) Run Langflow as a non-root user in a container with minimal privileges, a read-only filesystem where possible, and restricted egress. 5) Rotate API keys, database credentials and tokens stored in or reachable from Langflow if there is any suspicion of exposure. 6) Detection: monitor for unexpected child processes spawned by the Langflow process, anomalous outbound connections, unusual requests to flow-execution or component-validation endpoints, and unexpected changes to flows.

What does CISA's SSVC say?

DecisionTrack*

Exploitationnone

AutomatableYes

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code ExecutionData LeakageFrameworkAgentAML.T0010.001- AI Software AML.T0049- Exploit Public-Facing Application AML.T0050- Command and Scripting Interpreter AML.T0055- Unsecured Credentials

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Response to previously unknown risks and incidents

OWASP LLM Top 10

LLM03-Supply ChainLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-93674?

Is CVE-2026-93674 actively exploited?

A weaponized Metasploit module (exploit/multi/http/langflow_auth_command_injection_cve_2026_93674) exists for CVE-2026-93674, meaning the exploit is point-and-click and the risk of opportunistic exploitation is high.

How to fix CVE-2026-93674?

1) Upgrade Langflow OSS to the fixed version specified in the IBM advisory (https://www.ibm.com/support/pages/node/7290694). 2) Inventory all Langflow instances (including dev, shadow-IT and containerized ones) and identify versions 1.0.0 to 1.12.2. 3) Until patched, restrict network access with a VPN, IP allowlist or authenticating reverse proxy, and do not expose the service to the internet. 4) Run Langflow as a non-root user in a container with minimal privileges, a read-only filesystem where possible, and restricted egress. 5) Rotate API keys, database credentials and tokens stored in or reachable from Langflow if there is any suspicion of exposure. 6) Detection: monitor for unexpected child processes spawned by the Langflow process, anomalous outbound connections, unusual requests to flow-execution or component-validation endpoints, and unexpected changes to flows.

What systems are affected by CVE-2026-93674?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines, LLM orchestration platforms, visual workflow builders.

What is the CVSS score for CVE-2026-93674?

CVE-2026-93674 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 15.29%.

What is the AI security impact?

Affected AI Architectures

agent frameworksRAG pipelinesLLM orchestration platformsvisual workflow builders

MITRE ATLAS Techniques

AML.T0010.001AI Software

AML.T0049Exploit Public-Facing Application

AML.T0050Command and Scripting Interpreter

AML.T0055Unsecured Credentials

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03, LLM06

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.

Exploitation Scenario

An attacker scans for internet-exposed Langflow instances and identifies a version between 1.0.0 and 1.12.2. They send a crafted request containing shell metacharacters or injected code to the vulnerable endpoint, achieving command execution without authentication. They dump environment variables and the flow database to harvest LLM API keys and vector store credentials, establish a reverse shell for persistence, and then modify existing flows so the organization's agents exfiltrate data or run attacker-defined tools. Stolen keys are used to run costly LLM workloads or sold on.

Weaknesses (CWE)

CWE-94Improper Control of Generation of Code ('Code Injection')Primary CWE-94Improper Control of Generation of Code ('Code Injection')

CWE-94 — Improper Control of Generation of Code ('Code Injection'): The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

[Architecture and Design] Refactor your program so that you do not have to dynamically generate code.
[Architecture and Design] Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.