CVE-2026-17632: IBM Langflow OSS RCE Vulnerability

CVE-2026-17632 Overview

CVE-2026-17632 affects IBM Langflow OSS versions 1.0.0 through 1.10.3. The vulnerability allows a remote authenticated attacker to execute arbitrary code on the server. The root cause is improper validation of Python code during Abstract Syntax Tree (AST) based security scanning. Attackers can craft Python payloads that bypass the AST scanner and reach the execution path. The flaw maps to CWE-94: Improper Control of Generation of Code. IBM published details on the IBM Support Page.

Critical Impact
Authenticated attackers can execute arbitrary Python code on Langflow OSS hosts, leading to full compromise of confidentiality, integrity, and availability of the affected instance.

Affected Products

IBM Langflow OSS 1.0.0 through 1.10.3
Deployments exposing the Langflow API to authenticated users
Container and self-hosted Langflow installations in the affected range

Discovery Timeline

2026-08-05 - CVE-2026-17632 published to NVD
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-17632

Vulnerability Analysis

IBM Langflow OSS is a visual framework for building LLM-driven workflows. The platform accepts user-supplied Python code for custom components and nodes. To reduce risk, Langflow scans submitted code using an AST-based validator before execution. CVE-2026-17632 exists because the AST validator does not adequately model the full set of Python constructs that lead to code execution. An authenticated attacker submits Python source that appears benign to the AST scanner but reaches dangerous behavior once compiled or evaluated. The result is arbitrary code execution in the process context of the Langflow service.

Root Cause

The root cause is improper input validation in the security scanner [CWE-94]. The AST walker enforces an incomplete deny-list of nodes and attributes. Python offers many indirect paths to dynamic execution, including attribute lookups, decorators, comprehensions, and metaclass hooks. When the scanner fails to inspect these paths, malicious code passes validation. The authenticated attack surface means any user with component authoring permissions can trigger the flaw.

Attack Vector

The attack requires network access to the Langflow API and valid user credentials. The attacker submits a crafted component or flow definition containing Python source designed to bypass the AST scanner. Langflow validates the code, marks it as safe, and later executes it during flow evaluation. The payload then runs with the privileges of the Langflow worker process, enabling command execution, file access, credential theft, and lateral movement into connected model providers or data sources. No verified proof-of-concept code has been published. Refer to the IBM Support Page for vendor technical details.

Detection Methods for CVE-2026-17632

Indicators of Compromise

Langflow processes spawning unexpected child processes such as sh, bash, python, curl, or wget.
Outbound network connections from the Langflow container to unknown hosts shortly after component creation or flow execution.
Newly created or modified custom components containing dynamic constructs like __import__, getattr, compile, or exec chains.
Unusual filesystem writes under Langflow working directories or model cache paths.

Detection Strategies

Audit Langflow application logs for component submissions and correlate authoring events with subsequent process or network anomalies.
Inspect stored flows for Python source using indirect execution patterns that would defeat a simple AST deny-list.
Monitor container runtime behavior for shell invocations or interpreter re-entry from the Langflow service account.

Monitoring Recommendations

Enable verbose audit logging for all authenticated API actions that create or modify components and flows.
Forward Langflow host and container telemetry to a centralized analytics platform for behavioral correlation.
Alert on any egress traffic from Langflow workers to destinations outside the approved model and data provider allow-list.

How to Mitigate CVE-2026-17632

Immediate Actions Required

Upgrade IBM Langflow OSS to a fixed release above 1.10.3 as directed on the IBM Support Page.
Restrict Langflow access to trusted users and remove component authoring permissions from accounts that do not require them.
Review recently created or modified flows and custom components for suspicious Python constructs.
Rotate API keys, model provider tokens, and service credentials accessible to the Langflow process.

Patch Information

IBM has published remediation guidance on the IBM Support Page. Administrators should apply the vendor-supplied upgrade for Langflow OSS and verify the running version after deployment.

Workarounds

Place Langflow behind an authenticating reverse proxy and restrict access to a small operator group until patching completes.
Run Langflow in a hardened container with a read-only filesystem, no shell utilities, and egress filtering.
Disable custom component creation for standard users where the deployment supports role-based access control.

bash

# Verify installed Langflow version and upgrade to a fixed release
pip show langflow | grep -i version
pip install --upgrade langflow