CVE-2026-97676: Langflow: sandbox escape allows authenticated RCE

HIGH

Published October 7, 2026

CISO Take

CVE-2026-97676 is a code injection flaw (CWE-94) in IBM Langflow OSS 1.0.0 through 1.12.2 that lets any authenticated low-privilege user escape the code sandbox and run arbitrary commands on the host. Exploitation is easy (network, low complexity, no user interaction), but near-term likelihood looks moderate: EPSS is only 0.5% (top 57%), the CVE is not in CISA KEV, and there is no public exploit or Nuclei template. The package is a heavy hitter, though. Langflow has 194 other CVEs, a 77/100 package risk score and an active repository, and the vendor patch is only referenced in IBM's advisory. Upgrade to the fixed release listed in IBM's advisory (https://www.ibm.com/support/pages/node/7290694), restrict Langflow access to trusted users and networks, and review any instance holding LLM API keys or data connectors, since those secrets would be exposed on compromise.

Sources:NVDEPSSibm.comATLAS

What is the risk?

High (CVSS 8.8). The attack is network-reachable, low complexity, needs only low privileges and no user interaction, and gives full confidentiality, integrity and availability impact. Likelihood is moderate for now: EPSS 0.00536 (top 57%), not in CISA KEV, no public exploit, no Nuclei template, and no SSVC decision. Langflow's long CVE history (194 other CVEs) shows attackers and researchers actively examine its code execution paths, so a public proof of concept could appear quickly. The authentication requirement lowers risk for private deployments but not for multi-tenant instances, shared workspaces, or instances with open self-registration.

How does the attack unfold?

Initial Access

The attacker authenticates to a Langflow instance with a low-privilege account over the network.

AML.T0012

Exploitation

The attacker submits crafted code through a flow component that escapes the sandbox because of improper neutralization of special elements.

AML.T0049

Execution

Arbitrary commands run on the host as the Langflow service account.

AML.T0050

Impact

The attacker steals LLM API keys, vector database credentials and flow data, and can pivot into connected cloud and internal systems.

AML.T0097

Initial Access

The attacker authenticates to a Langflow instance with a low-privilege account over the network.

AML.T0012

Exploitation

The attacker submits crafted code through a flow component that escapes the sandbox because of improper neutralization of special elements.

AML.T0049

Execution

Arbitrary commands run on the host as the Langflow service account.

AML.T0050

Impact

The attacker steals LLM API keys, vector database credentials and flow data, and can pivot into connected cloud and internal systems.

AML.T0097

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
156.0KPushed 6d ago18% patched~66d to patchFull package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.7%

chance of exploitation in 30 days

Higher than 54% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade Langflow OSS to the fixed version named in the IBM advisory (https://www.ibm.com/support/pages/node/7290694); versions 1.0.0 through 1.12.2 are affected. 2) Until patched, restrict access to Langflow to trusted users behind VPN or SSO, and disable open self-registration. 3) Run Langflow in a hardened container with a non-root user, a read-only filesystem, no host mounts, and egress filtering. 4) Rotate LLM API keys, database credentials and other secrets stored in Langflow if compromise is suspected. 5) Detect: monitor for unexpected child processes spawned by the Langflow process, outbound connections to unknown hosts, and unusual custom component or code-execution API calls from low-privilege accounts. 6) Audit user accounts and flows for unauthorized custom code components.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code ExecutionFrameworkAgentAML.T0012- Valid Accounts AML.T0049- Exploit Public-Facing Application AML.T0050- Command and Scripting Interpreter AML.T0097- Virtualization/Sandbox Evasion

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Respond to and recover from unknown risks and incidents

OWASP LLM Top 10

LLM03-Supply ChainLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-97676?

Is CVE-2026-97676 actively exploited?

No confirmed active exploitation of CVE-2026-97676 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-97676?

1) Upgrade Langflow OSS to the fixed version named in the IBM advisory (https://www.ibm.com/support/pages/node/7290694); versions 1.0.0 through 1.12.2 are affected. 2) Until patched, restrict access to Langflow to trusted users behind VPN or SSO, and disable open self-registration. 3) Run Langflow in a hardened container with a non-root user, a read-only filesystem, no host mounts, and egress filtering. 4) Rotate LLM API keys, database credentials and other secrets stored in Langflow if compromise is suspected. 5) Detect: monitor for unexpected child processes spawned by the Langflow process, outbound connections to unknown hosts, and unusual custom component or code-execution API calls from low-privilege accounts. 6) Audit user accounts and flows for unauthorized custom code components.

What systems are affected by CVE-2026-97676?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines, LLM orchestration platforms, low-code AI workflow builders.

What is the CVSS score for CVE-2026-97676?

CVE-2026-97676 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.73%.

What is the AI security impact?

Affected AI Architectures

agent frameworksRAG pipelinesLLM orchestration platformslow-code AI workflow builders

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0049Exploit Public-Facing Application

AML.T0050Command and Scripting Interpreter

AML.T0097Virtualization/Sandbox Evasion

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03, LLM06

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in code, resulting in a sandbox escape.

Exploitation Scenario

An attacker obtains a low-privilege Langflow account, through open registration, a phished developer login or a leaked credential. They create or edit a flow containing a custom code or Python component with a payload that bypasses the sandbox restrictions, abusing improper neutralization of special elements in code. The payload runs on the host as the Langflow service user and reads environment variables and stored credentials, including LLM provider keys and vector database tokens. The attacker then exfiltrates those secrets, installs a reverse shell for persistence, and moves laterally into the cloud account or internal data stores connected to the AI platform.

Weaknesses (CWE)

CWE-94Improper Control of Generation of Code ('Code Injection')Primary CWE-94Improper Control of Generation of Code ('Code Injection')

CWE-94 — Improper Control of Generation of Code ('Code Injection'): The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

[Architecture and Design] Refactor your program so that you do not have to dynamically generate code.
[Architecture and Design] Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.