CVE-2026-97673: Langflow: input validation flaw allows authenticated RCE

HIGH

Published October 7, 2026

CISO Take

IBM Langflow OSS versions 1.0.0 through 1.12.2 contain an input validation flaw that lets a remote attacker with a low-privilege account execute arbitrary code on the server (CVSS 8.8). Langflow typically holds LLM provider API keys, vector database credentials, and connectors to internal data, so a single compromised instance can expose all of them. Exploitation pressure is currently modest: EPSS is 0.00435 (top 64%), the CVE is not in CISA KEV, and there is no public exploit or Nuclei template. However, the Langflow package has 194 other tracked CVEs and a package risk score of 77/100, which suggests a large, well-studied attack surface that attackers know how to probe. Upgrade to a release newer than 1.12.2 per the IBM advisory, and until you can, restrict Langflow to trusted networks and review who holds accounts on it.

Sources:NVDEPSSibm.comATLAS

What is the risk?

High. The CVSS vector (AV:N/AC:L/PR:L/UI:N) means any network-reachable instance is exposed to anyone holding a valid account, and exploitation needs no user interaction. Confidentiality, integrity, and availability impact are all rated high. Likelihood is moderated by the authentication requirement, the low EPSS score (0.00435), no KEV listing, and no known public exploit. The risk rises sharply for instances with open self-registration, shared or weak credentials, or internet exposure. The package has a heavy CVE history (194 other CVEs), which raises the odds that a working exploit emerges. The CWE classification (CWE-693, protection mechanism failure) is generic and says little about the exact flaw.

How does the attack unfold?

Initial Access

Attacker obtains or already holds a low-privilege Langflow account and reaches the instance over the network.

AML.T0012

Exploitation

Crafted input exploits improper validation in Langflow OSS (1.0.0 to 1.12.2) to run arbitrary code on the server.

AML.T0049

Credential and Data Access

Attacker reads stored LLM API keys, vector database credentials, and flow data from the host environment.

AML.T0050

Impact

Attacker tampers with flows, exfiltrates RAG data, abuses paid model APIs, or pivots into internal systems.

Initial Access

Attacker obtains or already holds a low-privilege Langflow account and reaches the instance over the network.

AML.T0012

Exploitation

Crafted input exploits improper validation in Langflow OSS (1.0.0 to 1.12.2) to run arbitrary code on the server.

AML.T0049

Credential and Data Access

Attacker reads stored LLM API keys, vector database credentials, and flow data from the host environment.

AML.T0050

Impact

Attacker tampers with flows, exfiltrates RAG data, abuses paid model APIs, or pivots into internal systems.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
156.0KPushed 6d ago18% patched~66d to patchFull package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.6%

chance of exploitation in 30 days

Higher than 49% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade Langflow OSS to a version newer than 1.12.2 as directed in the IBM advisory (https://www.ibm.com/support/pages/node/7290694); no patched version is listed in the structured data, so confirm the fixed release with IBM. 2) Until patched, take instances off the public internet and place them behind a VPN, SSO proxy, or IP allowlist. 3) Disable open self-registration, audit existing accounts, remove unused users, and rotate weak credentials. 4) Run Langflow in a container or VM with least-privilege IAM, no host mounts, and egress filtering. 5) Rotate API keys and secrets stored in Langflow if compromise is suspected. 6) Detect anomalies by monitoring for unexpected child processes spawned by the Langflow process, unusual outbound connections, and new or modified flows or custom components from low-privilege accounts.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code ExecutionFrameworkAgentAML.T0012- Valid Accounts AML.T0049- Exploit Public-Facing Application AML.T0050- Command and Scripting Interpreter

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

8.1-Operational planning and control

NIST AI RMF

MEASURE 2.7-AI system security and resilience are evaluated and documented

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-97673?

Is CVE-2026-97673 actively exploited?

No confirmed active exploitation of CVE-2026-97673 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-97673?

1) Upgrade Langflow OSS to a version newer than 1.12.2 as directed in the IBM advisory (https://www.ibm.com/support/pages/node/7290694); no patched version is listed in the structured data, so confirm the fixed release with IBM. 2) Until patched, take instances off the public internet and place them behind a VPN, SSO proxy, or IP allowlist. 3) Disable open self-registration, audit existing accounts, remove unused users, and rotate weak credentials. 4) Run Langflow in a container or VM with least-privilege IAM, no host mounts, and egress filtering. 5) Rotate API keys and secrets stored in Langflow if compromise is suspected. 6) Detect anomalies by monitoring for unexpected child processes spawned by the Langflow process, unusual outbound connections, and new or modified flows or custom components from low-privilege accounts.

What systems are affected by CVE-2026-97673?

This vulnerability affects the following AI/ML architecture patterns: LLM orchestration frameworks, agent frameworks, RAG pipelines, visual workflow builders, vector database integrations.

What is the CVSS score for CVE-2026-97673?

CVE-2026-97673 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.61%.

What is the AI security impact?

Affected AI Architectures

LLM orchestration frameworksagent frameworksRAG pipelinesvisual workflow buildersvector database integrations

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0049Exploit Public-Facing Application

AML.T0050Command and Scripting Interpreter

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: 8.1

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper input validation.

Exploitation Scenario

An attacker obtains a low-privilege Langflow account through credential stuffing, an exposed sign-up page, or a phished developer login. They send crafted input to the vulnerable endpoint, which the application fails to validate properly, and gain code execution as the Langflow service user. From there they read environment variables and the database to harvest LLM provider keys and vector store credentials, then plant a malicious component in a shared flow to persist. Finally they exfiltrate data from connected knowledge bases or pivot into the internal network.

Weaknesses (CWE)

CWE-693Protection Mechanism FailurePrimary CWE-693Protection Mechanism Failure

CWE-693 — Protection Mechanism Failure: The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Source: MITRE CWE corpus.