CVE-2026-93675: Langflow: dependency confusion enables remote code exec

CRITICAL

Published October 7, 2026

CISO Take

IBM Langflow OSS 1.0.0 through 1.12.2 is vulnerable to dependency confusion (CWE-440), where a remote attacker can trick the application into resolving an attacker-controlled package and running arbitrary code. The CVSS 8.8 score reflects network exploitation with low complexity and no privileges, but it requires user interaction, which limits mass exploitation. Current exploitation signals are weak: EPSS is 0.00678 (top 49% percentile), it is not in CISA KEV, there is no public exploit, and no Nuclei template exists. Even so, Langflow is a workflow orchestrator that typically holds LLM API keys and database credentials, so a successful compromise would have a large blast radius. Review the IBM advisory (support/pages/node/7290694), upgrade to the fixed release above 1.12.2 and restrict package sources until then.

Sources:NVDEPSSATLASibm.com

What is the risk?

Medium-high. Impact is full confidentiality, integrity and availability (C:H/I:H/A:H) via arbitrary code execution. Exploitability is moderated by the required user interaction and the lack of a public exploit, a Nuclei template, or KEV listing; EPSS 0.00678 indicates low short-term exploitation probability. Exposure rises sharply for internet-facing Langflow instances or instances whose build and install paths resolve packages from public registries. Note that the CWE data is sparse (CWE-440 listed twice) and the exact trigger path is not detailed in the available description, so confidence in specifics is MEDIUM.

How does the attack unfold?

Initial Access

Attacker publishes a malicious package under a name Langflow resolves from a public registry.

AML.T0010.001

User Execution

A user triggers installation or loading of the dependency, pulling in the attacker's package.

AML.T0011.001

Code Execution

The malicious package runs arbitrary code with the Langflow process privileges.

AML.T0050

Impact

Attacker steals LLM and database credentials, tampers with flows and pivots into the internal network.

Initial Access

Attacker publishes a malicious package under a name Langflow resolves from a public registry.

AML.T0010.001

User Execution

A user triggers installation or loading of the dependency, pulling in the attacker's package.

AML.T0011.001

Code Execution

The malicious package runs arbitrary code with the Langflow process privileges.

AML.T0050

Impact

Attacker steals LLM and database credentials, tampers with flows and pivots into the internal network.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
156.0KPushed 6d ago18% patched~66d to patchFull package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

0.6%

chance of exploitation in 30 days

Higher than 50% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade Langflow OSS to the fixed version referenced in the IBM advisory (https://www.ibm.com/support/pages/node/7290694); versions 1.0.0 through 1.12.2 are affected. 2) Until patched, restrict Langflow to trusted networks, put it behind authentication and a reverse proxy, and avoid exposing it to the internet. 3) Pin dependency versions with hashes, use a private package index with explicit index priority (avoid --extra-index-url), and reserve internal package names on public registries. 4) Block untrusted users from installing or loading custom components. 5) Detection: monitor pip/npm install events and outbound connections from Langflow hosts, audit installed packages against expected lockfiles, and rotate LLM and database credentials if suspicious packages are found.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Supply ChainCode ExecutionFrameworkAgentAML.T0010.001- AI Software AML.T0011.001- Malicious Package AML.T0050- Command and Scripting Interpreter

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.10.3-Suppliers

NIST AI RMF

GOVERN 6.1-Third-party AI risk policies

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-93675?

Is CVE-2026-93675 actively exploited?

No confirmed active exploitation of CVE-2026-93675 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-93675?

1) Upgrade Langflow OSS to the fixed version referenced in the IBM advisory (https://www.ibm.com/support/pages/node/7290694); versions 1.0.0 through 1.12.2 are affected. 2) Until patched, restrict Langflow to trusted networks, put it behind authentication and a reverse proxy, and avoid exposing it to the internet. 3) Pin dependency versions with hashes, use a private package index with explicit index priority (avoid --extra-index-url), and reserve internal package names on public registries. 4) Block untrusted users from installing or loading custom components. 5) Detection: monitor pip/npm install events and outbound connections from Langflow hosts, audit installed packages against expected lockfiles, and rotate LLM and database credentials if suspicious packages are found.

What systems are affected by CVE-2026-93675?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines, LLM orchestration platforms, low-code AI workflow builders.

What is the CVSS score for CVE-2026-93675?

CVE-2026-93675 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 0.63%.

What is the AI security impact?

Affected AI Architectures

agent frameworksRAG pipelinesLLM orchestration platformslow-code AI workflow builders

MITRE ATLAS Techniques

AML.T0010.001AI Software

AML.T0011.001Malicious Package

AML.T0050Command and Scripting Interpreter

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.10.3

NIST AI RMF: GOVERN 6.1

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to an expected dependency confusion.

Exploitation Scenario

An attacker identifies an internal or expected package name that Langflow resolves during installation or component loading and publishes a higher-version package with the same name on a public registry. A user or administrator is induced to trigger the install or load action (user interaction required), for example by importing a shared flow or component. The malicious package then runs its payload with the privileges of the Langflow process, exfiltrating stored API keys and flow data and establishing a reverse shell into the AI platform.