CVE-2026-97678: Langflow: authenticated RCE via improper input validation

HIGH

Published October 7, 2026

CISO Take

IBM Langflow OSS 1.0.0 through 1.12.2 contains an input validation flaw that lets any authenticated user execute arbitrary code on the server, with a CVSS of 8.8 over the network, low complexity and no user interaction. Exploitation likelihood is currently low: EPSS is 0.00406 (top 67%), the CVE is not in CISA KEV, and there is no public exploit or Nuclei template. Even so, Langflow servers typically hold LLM API keys, vector DB credentials and connectors to internal data, so a low-privilege account is enough to turn into full host compromise and lateral movement. Langflow has a history of RCE flaws that were weaponized quickly, so do not wait for a PoC. Review the IBM advisory (support/pages/node/7290694), upgrade beyond 1.12.2 to the fixed release, and until then restrict access to the Langflow UI/API and audit who holds accounts.

Sources:NVDEPSSibm.comATLAS

What is the risk?

High. CVSS 8.8 with network vector, low complexity, low privileges and no user interaction, with high impact on confidentiality, integrity and availability. Real-world likelihood is moderate to low today (EPSS 0.00406, not in KEV, no public exploit or scanner template), but the risk rises sharply if the instance is exposed to the internet, allows open self-registration, or shares accounts. The CWE-693 (protection mechanism failure) classification suggests a bypass of a validation or sandboxing control. Package risk data (dependents, Scorecard) is unavailable, so blast radius is not quantified.

How does the attack unfold?

Initial Access

Attacker obtains low-privilege credentials on a reachable Langflow instance.

AML.T0012

Exploitation

Crafted input bypasses validation, leading to arbitrary code execution on the server.

AML.T0049

Credential Access

Attacker harvests LLM API keys, vector DB credentials and environment secrets stored by Langflow.

AML.T0055

Impact

Full host compromise, data exfiltration and tampering with AI flows or lateral movement into connected systems.

AML.T0050

Initial Access

Attacker obtains low-privilege credentials on a reachable Langflow instance.

AML.T0012

Exploitation

Crafted input bypasses validation, leading to arbitrary code execution on the server.

AML.T0049

Credential Access

Attacker harvests LLM API keys, vector DB credentials and environment secrets stored by Langflow.

AML.T0055

Impact

Full host compromise, data exfiltration and tampering with AI flows or lateral movement into connected systems.

AML.T0050

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
156.0KPushed 6d ago18% patched~66d to patchFull package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.6%

chance of exploitation in 30 days

Higher than 47% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade Langflow OSS to the fixed version indicated in the IBM advisory (above 1.12.2). 2) Until patched, place Langflow behind a VPN or an authenticating reverse proxy, disable open registration, and remove unnecessary or shared accounts. 3) Run the service as a non-root user in a hardened container with minimal egress and no access to the cloud metadata service. 4) Rotate API keys and secrets stored in Langflow if compromise is suspected, and move secrets to a secrets manager. 5) Detection: monitor for unusual child processes spawned by the Langflow process, unexpected outbound connections, and creation or modification of flows/components by low-privilege users; review API logs for custom component or code validation endpoints being hit abnormally.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code ExecutionFrameworkAgentAML.T0012- Valid Accounts AML.T0049- Exploit Public-Facing Application AML.T0050- Command and Scripting Interpreter

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Response to previously unknown or newly identified risks

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-97678?

Is CVE-2026-97678 actively exploited?

No confirmed active exploitation of CVE-2026-97678 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-97678?

1) Upgrade Langflow OSS to the fixed version indicated in the IBM advisory (above 1.12.2). 2) Until patched, place Langflow behind a VPN or an authenticating reverse proxy, disable open registration, and remove unnecessary or shared accounts. 3) Run the service as a non-root user in a hardened container with minimal egress and no access to the cloud metadata service. 4) Rotate API keys and secrets stored in Langflow if compromise is suspected, and move secrets to a secrets manager. 5) Detection: monitor for unusual child processes spawned by the Langflow process, unexpected outbound connections, and creation or modification of flows/components by low-privilege users; review API logs for custom component or code validation endpoints being hit abnormally.

What systems are affected by CVE-2026-97678?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, LLM orchestration platforms, RAG pipelines, low-code AI workflow builders.

What is the CVSS score for CVE-2026-97678?

CVE-2026-97678 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.57%.

What is the AI security impact?

Affected AI Architectures

agent frameworksLLM orchestration platformsRAG pipelineslow-code AI workflow builders

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0049Exploit Public-Facing Application

AML.T0050Command and Scripting Interpreter

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper input validation.

Exploitation Scenario

An attacker obtains low-privilege credentials on an exposed or internally shared Langflow instance (via phishing, credential reuse, or open signup). They send a crafted request to an endpoint that processes user-supplied flow or component input without proper validation, achieving arbitrary code execution on the server. From there they dump environment variables containing LLM and vector DB API keys, install a reverse shell, and move laterally to connected data stores, or silently modify production flows to exfiltrate user prompts and retrieved data.

Weaknesses (CWE)

CWE-693Protection Mechanism FailurePrimary CWE-693Protection Mechanism Failure

CWE-693 — Protection Mechanism Failure: The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Source: MITRE CWE corpus.