CVE-2026-97655: Langflow incomplete blocklist enables

CISO Take

CVE-2026-97655 is a code injection flaw (CWE-94) in Langflow OSS 1.0.0 through 1.12.2, where the code security scanner relies on an incomplete blocklist that an authenticated user can bypass to execute arbitrary code on the server. The CVSS of 8.8 is driven by network reachability, low complexity and no user interaction, but exploitation needs a low-privilege account, which limits exposure for instances that are not open to the internet. Near-term exploitation likelihood looks modest: EPSS is 0.00536 (57th percentile), it is not in CISA KEV, and there is no public exploit or Nuclei template. Even so, Langflow has 194 other CVEs and a package risk score of 77/100, and blocklist-style fixes tend to be bypassed repeatedly, so assume researchers and attackers will be probing this area. Check IBM's advisory (ibm.com/support/pages/node/7290694) for the fixed release, upgrade past 1.12.2, and until then restrict Langflow to trusted users behind authentication and network controls, and run it in a sandboxed, least-privilege container with no standing cloud or LLM API credentials.

Sources:NVDEPSSATLASibm.com

What is the risk?

Medium-high. Impact is full confidentiality, integrity and availability loss on the host (C:H/I:H/A:H), and attack complexity is low. Exploitation requires a low-privileged account (PR:L), and there is no KEV listing, public exploit or scanner template, with EPSS in the 57th percentile. Risk rises sharply for internet-exposed instances with open sign-up, shared multi-tenant deployments, or instances holding LLM API keys, vector database credentials and other secrets. Langflow's long CVE history (194 other CVEs) indicates a recurring weakness class around code execution features.

How does the attack unfold?

Initial Access

Attacker obtains a low-privilege account on a reachable Langflow instance.

AML.T0049

Exploitation

Attacker submits Python code that evades the incomplete blocklist in the code security scanner and gets it executed.

AML.T0050

Credential Access

Attacker reads environment variables and stored secrets for LLM providers, vector databases and data sources.

Impact

Attacker gains host-level control, tampers with flows and pivots into connected internal systems.

Initial Access

Attacker obtains a low-privilege account on a reachable Langflow instance.

AML.T0049

Exploitation

Attacker submits Python code that evades the incomplete blocklist in the code security scanner and gets it executed.

AML.T0050

Credential Access

Attacker reads environment variables and stored secrets for LLM providers, vector databases and data sources.

Impact

Attacker gains host-level control, tampers with flows and pivots into connected internal systems.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
156.0KPushed 6d ago18% patched~66d to patchFull package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.8%

chance of exploitation in 30 days

Higher than 56% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade Langflow to the fixed release listed in the IBM advisory (anything above 1.12.2). 2) Until patched, disable open registration, restrict access to trusted users, and place the instance behind a VPN or an authenticated reverse proxy with IP allowlisting. 3) Run Langflow in a minimal container as a non-root user, with a read-only filesystem where possible, no host mounts, and egress filtering. 4) Rotate and scope any secrets (LLM provider keys, database credentials) stored in or reachable from Langflow, and prefer short-lived credentials. 5) Detection: alert on custom component or code-validation API calls from unexpected accounts, on child processes spawned by the Langflow service (shells, curl, wget, python -c), and on unusual outbound connections from the host. 6) Review flows and components for unauthorized changes and audit recent account creation.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code ExecutionFrameworkAgentAML.T0010.001- AI Software AML.T0049- Exploit Public-Facing Application AML.T0050- Command and Scripting Interpreter

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Procedures to respond to and recover from unknown risks

OWASP LLM Top 10

LLM03-Supply ChainLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-97655?

CVE-2026-97655 is a code injection flaw (CWE-94) in Langflow OSS 1.0.0 through 1.12.2, where the code security scanner relies on an incomplete blocklist that an authenticated user can bypass to execute arbitrary code on the server. The CVSS of 8.8 is driven by network reachability, low complexity and no user interaction, but exploitation needs a low-privilege account, which limits exposure for instances that are not open to the internet. Near-term exploitation likelihood looks modest: EPSS is 0.00536 (57th percentile), it is not in CISA KEV, and there is no public exploit or Nuclei template. Even so, Langflow has 194 other CVEs and a package risk score of 77/100, and blocklist-style fixes tend to be bypassed repeatedly, so assume researchers and attackers will be probing this area. Check IBM's advisory (ibm.com/support/pages/node/7290694) for the fixed release, upgrade past 1.12.2, and until then restrict Langflow to trusted users behind authentication and network controls, and run it in a sandboxed, least-privilege container with no standing cloud or LLM API credentials.

Is CVE-2026-97655 actively exploited?

No confirmed active exploitation of CVE-2026-97655 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-97655?

1) Upgrade Langflow to the fixed release listed in the IBM advisory (anything above 1.12.2). 2) Until patched, disable open registration, restrict access to trusted users, and place the instance behind a VPN or an authenticated reverse proxy with IP allowlisting. 3) Run Langflow in a minimal container as a non-root user, with a read-only filesystem where possible, no host mounts, and egress filtering. 4) Rotate and scope any secrets (LLM provider keys, database credentials) stored in or reachable from Langflow, and prefer short-lived credentials. 5) Detection: alert on custom component or code-validation API calls from unexpected accounts, on child processes spawned by the Langflow service (shells, curl, wget, python -c), and on unusual outbound connections from the host. 6) Review flows and components for unauthorized changes and audit recent account creation.

What systems are affected by CVE-2026-97655?

This vulnerability affects the following AI/ML architecture patterns: Agent frameworks, LLM workflow orchestration, RAG pipelines, Low-code AI application builders.

What is the CVSS score for CVE-2026-97655?

CVE-2026-97655 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.78%.

What is the AI security impact?

Affected AI Architectures

Agent frameworksLLM workflow orchestrationRAG pipelinesLow-code AI application builders

MITRE ATLAS Techniques

AML.T0010.001AI Software

AML.T0049Exploit Public-Facing Application

AML.T0050Command and Scripting Interpreter

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03, LLM06

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to an incomplete blocklist in the code security scanner.

Exploitation Scenario

An attacker obtains or registers a low-privilege account on an exposed Langflow instance, then submits a custom component containing Python code crafted to use constructs missing from the scanner's blocklist. The scanner accepts the code and the server executes it, giving a shell in the Langflow process. The attacker reads environment variables and stored credentials for LLM providers and vector databases, pivots to internal data sources, and may modify production flows to persist or silently exfiltrate prompts and data.

Weaknesses (CWE)

CWE-94Improper Control of Generation of Code ('Code Injection')Primary CWE-94Improper Control of Generation of Code ('Code Injection')

CWE-94 — Improper Control of Generation of Code ('Code Injection'): The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

[Architecture and Design] Refactor your program so that you do not have to dynamically generate code.
[Architecture and Design] Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.