CVE-2026-13448: Langflow RCE Vulnerability

CVE-2026-13448 Overview

CVE-2026-13448 is an unauthenticated remote code execution vulnerability in IBM Langflow OSS versions 1.0.0 through 1.10.1. The flaw resides in the public flow build endpoint /api/v1/build_public_tmp/{flow_id}/flow. The validate_public_flow_no_code_execution() function uses an incomplete denylist that fails to block several code-execution agent components, including OpenDsStarAgent, CodeActAgentSmolagents, and CSVAgent. Attackers can reach this endpoint over the network without authentication and execute arbitrary code on the host operating system. The vulnerability is classified under [CWE-184] (Incomplete List of Disallowed Inputs).

Critical Impact
Unauthenticated attackers can execute arbitrary code on Langflow OSS servers by submitting crafted public flows that invoke agent components missing from the denylist.

Affected Products

IBM Langflow OSS versions 1.0.0 through 1.10.1
Deployments on Linux kernel-based hosts
Deployments on Apple macOS and Microsoft Windows hosts

Discovery Timeline

2026-07-17 - CVE-2026-13448 published to the National Vulnerability Database
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-13448

Vulnerability Analysis

Langflow OSS exposes a public flow build endpoint intended to let unauthenticated users invoke flows without arbitrary code execution. The validate_public_flow_no_code_execution() function enforces this restriction using a denylist of component class names known to execute code. The denylist is incomplete. Agent components such as OpenDsStarAgent, CodeActAgentSmolagents, and CSVAgent are not present in the list, yet each is capable of executing attacker-controlled Python code as part of normal agent operation.

An attacker who sends a POST request to /api/v1/build_public_tmp/{flow_id}/flow with a flow definition referencing one of the missing agent components bypasses the guardrail. The Langflow runtime then instantiates the agent and evaluates the attacker-supplied code path in the context of the Langflow process.

Root Cause

The root cause is a denylist-based validation strategy [CWE-184]. Denylists require exhaustive enumeration of every dangerous component, and any component added to Langflow that executes code must be manually added to the block list. Missing entries convert into direct code execution paths. An allowlist of safe, non-executing components would prevent this class of bypass.

Attack Vector

Exploitation requires only network access to a Langflow OSS instance exposing the public flow endpoint. No credentials, user interaction, or prior access are required. The attacker crafts a JSON flow definition containing a node whose component type matches one of the unlisted agent classes and includes attacker-controlled instructions or code payloads. Submitting this flow to the public build endpoint triggers execution under the identity of the Langflow service account.

No verified public exploit or proof-of-concept URL has been published in the enriched data. Technical details are described in the IBM Support Page.

Detection Methods for CVE-2026-13448

Indicators of Compromise

HTTP POST requests to /api/v1/build_public_tmp/{flow_id}/flow originating from external or unexpected source addresses.
Flow payloads referencing component types OpenDsStarAgent, CodeActAgentSmolagents, or CSVAgent on the public endpoint.
Child processes spawned by the Langflow Python interpreter, such as sh, bash, powershell.exe, cmd.exe, or curl.
Outbound network connections from the Langflow host to previously unseen domains shortly after public flow builds.

Detection Strategies

Inspect reverse-proxy and application logs for requests to the build_public_tmp route and alert on any use of the affected agent component names in the request body.
Baseline the process tree of the Langflow service and alert on unexpected child processes or interactive shells.
Correlate public flow build events with file writes to temporary or world-writable directories on the host.

Monitoring Recommendations

Forward Langflow application logs, web-server access logs, and host process telemetry to a centralized analytics platform for correlation.
Monitor egress traffic from Langflow hosts for connections to command-and-control indicators and cryptomining pools.
Track version and configuration drift on Langflow deployments to confirm patched builds remain in place.

How to Mitigate CVE-2026-13448

Immediate Actions Required

Upgrade Langflow OSS to a fixed release above 1.10.1 as indicated by the IBM Support Page.
Restrict network exposure of Langflow instances to trusted internal networks and place them behind an authenticating reverse proxy.
Audit Langflow hosts for signs of prior exploitation, including unexpected processes, cron jobs, and outbound connections.

Patch Information

IBM has published remediation guidance and fixed versions. Refer to the IBM Support Page for the current patched release and upgrade instructions. Apply the vendor-supplied update to all Langflow OSS installations running versions 1.0.0 through 1.10.1.

Workarounds

Disable or block the /api/v1/build_public_tmp/{flow_id}/flow endpoint at the reverse proxy or web application firewall until the patch is applied.
Require authentication for all Langflow API routes by placing the service behind an identity-aware proxy.
Run Langflow as a low-privilege user inside a container with no outbound network access to limit post-exploitation impact.
Remove or disable agent components such as OpenDsStarAgent, CodeActAgentSmolagents, and CSVAgent from the Langflow component directory if they are not required.

bash

# Example: block the vulnerable public endpoint at an nginx reverse proxy
location ~ ^/api/v1/build_public_tmp/ {
    return 403;
}