CVE-2026-97679: Langflow: authenticated code injection allows RCE

HIGH

Published October 7, 2026

CISO Take

IBM Langflow OSS 1.0.0 through 1.12.2 contains a code injection flaw (CWE-94) that lets any authenticated user run arbitrary code on the server. It is network-reachable, low complexity and needs no user interaction (CVSS 8.8). Urgency is moderate for now: EPSS is 0.00439 (top 64%), the CVE is not in CISA KEV, and we found no public exploit or Nuclei template. Langflow instances usually hold LLM API keys, vector database credentials and flow definitions, so a low-privilege account becoming full host compromise is a serious blast radius. Check which Langflow versions you run, apply the fix described in the IBM advisory (ibm.com/support/pages/node/7290694), and restrict access to the instance until you have patched.

Sources:NVDEPSSibm.comATLAS

What is the risk?

High but not urgent. The CVSS 8.8 score reflects network attack vector, low complexity, low privileges and full CIA impact. Exploitation needs a valid account, which lowers exposure on instances with tightly controlled access. It raises the risk on multi-user, shared or internet-facing deployments, and where self-registration is enabled or credentials are weak or reused. EPSS is low (0.00439, top 64%), there is no KEV listing, no public exploit and no scanner template, but Langflow has a history of attacker interest, so this could change quickly once technical details circulate. Dependent count and package risk data are unavailable (Sin datos).

How does the attack unfold?

Initial Access

Attacker obtains or registers a low-privilege authenticated account on a reachable Langflow instance.

AML.T0012

Exploitation

Attacker sends crafted input that is not properly neutralized, causing the server to execute injected code.

AML.T0049

Execution

Arbitrary commands run in the Langflow server process with its privileges.

AML.T0050

Impact

Attacker steals LLM and database credentials, tampers with flows and pivots into the internal network.

Initial Access

Attacker obtains or registers a low-privilege authenticated account on a reachable Langflow instance.

AML.T0012

Exploitation

Attacker sends crafted input that is not properly neutralized, causing the server to execute injected code.

AML.T0049

Execution

Arbitrary commands run in the Langflow server process with its privileges.

AML.T0050

Impact

Attacker steals LLM and database credentials, tampers with flows and pivots into the internal network.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
156.0KPushed 6d ago18% patched~66d to patchFull package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.7%

chance of exploitation in 30 days

Higher than 51% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Identify Langflow deployments running 1.0.0 through 1.12.2 (pip inventory, container images, IBM-packaged distributions). 2) Upgrade to the fixed version listed in the IBM advisory: https://www.ibm.com/support/pages/node/7290694. 3) Until patched, put the instance behind a VPN or an authenticating reverse proxy, disable open self-registration, and review and remove unneeded accounts. 4) Run Langflow as an unprivileged user in a container with a minimal filesystem, restricted egress and no host-level credentials. 5) Rotate LLM API keys, database credentials and other secrets on any instance that may have been exposed. 6) Detection: monitor for unexpected child processes spawned by the Langflow process, outbound connections from the server to unfamiliar hosts, and unusual flow or component creation and edits by low-privilege users.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code ExecutionFrameworkAgentAML.T0012- Valid Accounts AML.T0049- Exploit Public-Facing Application AML.T0050- Command and Scripting Interpreter

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responses to previously unknown risks and mechanisms for deactivation

OWASP LLM Top 10

LLM03-Supply ChainLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-97679?

Is CVE-2026-97679 actively exploited?

No confirmed active exploitation of CVE-2026-97679 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-97679?

1) Identify Langflow deployments running 1.0.0 through 1.12.2 (pip inventory, container images, IBM-packaged distributions). 2) Upgrade to the fixed version listed in the IBM advisory: https://www.ibm.com/support/pages/node/7290694. 3) Until patched, put the instance behind a VPN or an authenticating reverse proxy, disable open self-registration, and review and remove unneeded accounts. 4) Run Langflow as an unprivileged user in a container with a minimal filesystem, restricted egress and no host-level credentials. 5) Rotate LLM API keys, database credentials and other secrets on any instance that may have been exposed. 6) Detection: monitor for unexpected child processes spawned by the Langflow process, outbound connections from the server to unfamiliar hosts, and unusual flow or component creation and edits by low-privilege users.

What systems are affected by CVE-2026-97679?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, LLM orchestration platforms, RAG pipelines, low-code AI workflow builders.

What is the CVSS score for CVE-2026-97679?

CVE-2026-97679 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.66%.

What is the AI security impact?

Affected AI Architectures

agent frameworksLLM orchestration platformsRAG pipelineslow-code AI workflow builders

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0049Exploit Public-Facing Application

AML.T0050Command and Scripting Interpreter

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03, LLM06

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command ('Code Injection') related to improper input validation.

Exploitation Scenario

An attacker obtains a low-privilege Langflow account, through a leaked credential, open registration, or a compromised internal user. They submit crafted input to a vulnerable component or endpoint that fails to neutralize special elements, so the server evaluates attacker-controlled code. They gain a shell in the Langflow process, dump the environment for LLM and vector DB keys, modify production flows to exfiltrate user prompts, and use the host as a foothold to reach internal services.

Weaknesses (CWE)

CWE-94Improper Control of Generation of Code ('Code Injection')Primary CWE-94Improper Control of Generation of Code ('Code Injection')

CWE-94 — Improper Control of Generation of Code ('Code Injection'): The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

[Architecture and Design] Refactor your program so that you do not have to dynamically generate code.
[Architecture and Design] Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product. Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection. This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise. Be careful to avoid CWE-243 and other weaknesses related to jails.

Source: MITRE CWE corpus.