EUVD-2026-40404
GHSA-mgqp-4wrr-7886
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Unauthenticated network-reachable code injection via the build API (AV:N/AC:L/PR:N/UI:N) with cross-tenant impact (S:C) and full C/I/A compromise of the process.
Primary rating from Vendor (us).
CVSS VectorVendor: us
Lifecycle Timeline
1DescriptionCVE.org
IBM Langflow OSS 1.0.0 through 1.9.3 allows an attacker to read every secret available to the Langflow process, read and modify every flow, conversation, message, file upload, and saved component in the Langflow database, can connect to internal services, abuse cloud metadata endpoints, laterally move to other tenants on the same Langflow instance, and Establish persistence by modifying the public flow's tool_code so normal /api/v1/build/... calls by any user re-execute attacker code at each build.
AnalysisAI
Remote code execution in IBM Langflow OSS 1.0.0 through 1.9.3 lets an unauthenticated attacker inject and run arbitrary Python via the flow tool_code mechanism, gaining full control of the Langflow process. Because the scope changes (S:C), the attacker can read every process secret, read and tamper with all flows, conversations, messages, uploads and saved components in the database, reach internal services and cloud metadata endpoints, and pivot across tenants on the same instance. This is a maximum-severity (CVSS 10.0) flaw, though no public exploit has been identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
Langflow is a popular open-source, low-code visual framework for building LLM/agentic applications, where users assemble 'flows' from components that are compiled and executed server-side. The root cause is CWE-94 (Improper Control of Generation of Code / code injection): user-controllable tool_code associated with a flow is evaluated by the Langflow runtime when a build is triggered through /api/v1/build/.... Because the affected CPE range covers Langflow OSS 1.0.0-1.9.3 across all deployments, any instance exposing the build/flow API evaluates this attacker-supplied code in the security context of the Langflow process, giving access to its environment secrets and database, and to any network the host can reach (internal services, cloud metadata at 169.254.169.254-style endpoints).
RemediationAI
Upgrade to the fixed release identified in IBM's advisory at https://www.ibm.com/support/pages/node/7277559 - patch available per vendor advisory; the input does not state an exact fixed version, so confirm the precise build from that page (all 1.0.0-1.9.3 releases are vulnerable). Until patched, remove the instance from untrusted network exposure: restrict or block access to the /api/v1/build/... and flow-management endpoints to trusted, authenticated users only (e.g. front it with an authenticating reverse proxy or network ACL), which prevents anonymous build/flow submission at the cost of breaking any anonymous/public-flow usage. Additionally, deny the Langflow host egress to cloud metadata endpoints (block 169.254.169.254) and to internal management services to blunt SSRF/metadata abuse and lateral movement, accepting that flows legitimately needing those services will fail. Audit existing flows for unexpected tool_code and rotate any secrets exposed to the Langflow process, since a successful exploit could already have read them.
Langflow before 1.3.0 allows unauthenticated remote code injection through the /api/v1/validate/code endpoint, enabling
Account takeover and remote code execution in Langflow AI workflow platform versions ≤1.6.9 due to a CORS misconfigurati
Langflow has a third RCE vulnerability via exec_globals (EPSS 10.0%) allowing inclusion of untrusted code that executes
Code injection in Langflow CSV Agent node before 1.8.0. The node hardcodes allow_dangerous_code=True, enabling arbitrary
Langflow has a code injection vulnerability in the code component (EPSS 2.6%) enabling remote code execution through the
Langflow through 0.6.19 allows remote code execution if untrusted users are able to reach the "POST /api/v1/custom_compo
langflow <=1.0.18 is vulnerable to Remote Code Execution (RCE) as any component provided the code functionality and the
langflow v1.0.12 was discovered to contain a remote code execution (RCE) vulnerability via the PythonCodeTool component.
Langflow before 1.7.0.dev45 exposes multiple API endpoints without authentication, allowing unauthenticated access to us
An unauthenticated shell injection vulnerability exists in Langflow's GitHub Actions CI/CD workflows, allowing attackers
Arbitrary file write vulnerability in an API endpoint (POST /api/v2/files) enables authenticated remote attackers to ove
Langflow versions prior to 1.0.13 suffer from a Privilege Escalation vulnerability, allowing a remote and low privileged
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today