Langflow unauthenticated RCE (CVE-2026-93674) [PoC]

Exploitation confirmed - public proof-of-concept - CVE-2026-93674 is a critical OS command injection flaw in IBM Langflow OSS 1.0.0 through 1.12.2 that grants unauthenticated remote code execution. No vendor patch has been confirmed; treat every internet-facing Langflow instance as compromised until upgraded.

Overview

Langflow is an open-source low-code tool for building AI agents and LLM workflows. It accepts user-supplied inputs that are passed to the underlying operating system without proper neutralization of special elements - the classic command injection pattern. Because the vulnerable code path is reachable without authentication, an attacker needs only network access to the service and can run arbitrary commands with the privileges of the Langflow process.

The CVSS score of 9.8 reflects the worst case: attack vector NETWORK, attack complexity LOW, privileges required NONE, and user interaction NONE. In plain terms, there is no gate in front of the bug. A single crafted request can execute shell commands on the host.

Impact

A successful exploit gives the attacker full control over the Langflow server. From there, typical escalation paths include reading environment variables that hold API keys for model providers, exfiltrating workflow data and prompt history, pivoting to other services reachable from the host, and installing persistent backdoors. Langflow deployments often sit inside internal networks with broad access to cloud metadata endpoints, which makes them a high-value first hop for lateral movement.

Remediation

• Check the running version of Langflow. Any release from 1.0.0 through 1.12.2 is affected.
• Upgrade to the latest patched release as soon as IBM publishes it, or to version 1.12.3 or later if available for your distribution.
• If you cannot upgrade immediately, restrict network access to the Langflow web interface. Do not expose it to the public internet. Place it behind an authenticating reverse proxy and allow only trusted source addresses.
• Run Langflow under a low-privilege service account with no access to sensitive credentials or cloud instance metadata.
• Rotate any API keys, database passwords, and tokens that were present in the environment of an exposed instance.
• Review logs for unexpected outbound connections or child processes spawned by the Langflow service.

Security Insight

Command injection in AI tooling is becoming a recurring theme: the same low-code convenience that lets users wire prompts to shell utilities also hands attackers a direct execution path. Langflow’s design decision to expose that path without authentication turns an integration feature into a 9.8. This mirrors the pattern seen across the 2024-2025 wave of RCE bugs in workflow and automation platforms, where the vendor optimized for developer velocity and deferred hardening. Teams running AI infrastructure should treat such tools as hostile-facing services from day one. For related coverage, see our security news and breach reports.

Further Reading

• All Critical Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs