CVE-2026-18729: Langflow RCE Vulnerability

CVE-2026-18729 Overview

CVE-2026-18729 is a remote code execution vulnerability in IBM Langflow OSS versions 1.0.0 through 1.11.1. The flaw stems from improper control of code generation [CWE-94], which allows a remote authenticated attacker to execute arbitrary code on the host running Langflow. Langflow is an open-source visual framework used to build agentic and retrieval-augmented generation (RAG) workflows on top of large language models.

Critical Impact
An authenticated attacker with network access to a Langflow instance can execute arbitrary code, leading to full compromise of confidentiality, integrity, and availability.

Affected Products

IBM Langflow OSS 1.0.0
IBM Langflow OSS versions 1.0.0 through 1.11.1
Langflow deployments matching CPE cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*

Discovery Timeline

2026-08-28 - CVE-2026-18729 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-18729

Vulnerability Analysis

CVE-2026-18729 is classified under CWE-94, Improper Control of Generation of Code ("Code Injection"). Langflow accepts user-defined logic within flow components, including Python expressions and custom code nodes used to compose LLM workflows. When the application processes these inputs, it does not sufficiently restrict the code paths that get generated and evaluated at runtime.

An authenticated user can craft a component payload that Langflow subsequently compiles or evaluates inside the server process. The resulting code executes with the privileges of the Langflow service. Because Langflow is often deployed as a backend for AI pipelines, the process typically has access to model API keys, vector databases, and internal network resources.

The EPSS score is 0.474% (39th percentile) as of 2026-09-03, indicating limited observed exploitation activity at publication time.

Root Cause

The root cause is insufficient validation and sandboxing of user-supplied code and expressions inside Langflow component definitions. Instead of restricting execution to a whitelisted set of operations, the application generates and evaluates code derived from attacker-controllable fields. Any authenticated user with permission to create or edit flows can supply expressions that reach the code generation layer.

Attack Vector

The attack vector is network-based and requires low privileges but no user interaction. A remote attacker who has obtained a valid Langflow account, whether through weak credentials, credential reuse, or a self-service registration path, submits a malicious flow or component. Langflow evaluates the injected code server-side and returns the results through the normal API response. The attacker gains code execution equivalent to the Langflow service account.

No verified public proof-of-concept is available. See the IBM Security Advisory for vendor technical details.

Detection Methods for CVE-2026-18729

Indicators of Compromise

Unexpected child processes spawned by the Langflow Python process, such as sh, bash, curl, wget, or python -c
Outbound network connections from the Langflow host to unfamiliar domains or raw IP addresses shortly after flow edits
New or modified flow definitions containing exec, eval, __import__, subprocess, or os.system in component code fields
Anomalous read access to environment variables, .env files, or cloud metadata endpoints (169.254.169.254) from the Langflow service

Detection Strategies

Enable audit logging on Langflow flow creation and update endpoints, and alert on payloads containing Python built-ins associated with dynamic execution
Baseline the process tree of the Langflow container or service and alert on deviations, especially shell interpreters as children of the Python runtime
Correlate authenticated Langflow API activity with subsequent egress traffic to detect post-exploitation callbacks

Monitoring Recommendations

Forward Langflow application logs, container runtime logs, and host process telemetry to a centralized analytics platform for correlation
Monitor authentication events for brute force, credential stuffing, and newly registered accounts that immediately create or modify flows
Track file integrity on Langflow configuration, cache, and component directories to detect persistence attempts

How to Mitigate CVE-2026-18729

Immediate Actions Required

Upgrade Langflow to a version later than 1.11.1 that contains the vendor fix referenced in the IBM advisory
Restrict network exposure of Langflow to trusted internal networks or VPN-only access until patching is complete
Disable self-service account registration and enforce strong authentication, including multi-factor authentication, for all Langflow users
Review existing flows and components for unauthorized code, and revoke API keys or secrets that were reachable from the Langflow process

Patch Information

IBM has published remediation guidance in the IBM Security Advisory covering CVE-2026-18729. Administrators should apply the fixed Langflow OSS release identified in the advisory and redeploy affected containers or virtual machines from clean images.

Workarounds

Run Langflow as a non-privileged user inside a hardened container with a read-only filesystem and no access to host secrets
Apply egress network policies that block outbound traffic from the Langflow host except to required LLM and database endpoints
Place Langflow behind an authenticating reverse proxy and restrict the flow editor endpoints to a small group of trusted operators
Rotate any credentials, tokens, or model API keys accessible from the Langflow environment after upgrading

bash

# Example: restrict Langflow to loopback and require reverse-proxy auth
export LANGFLOW_HOST=127.0.0.1
export LANGFLOW_PORT=7860
export LANGFLOW_AUTO_LOGIN=false
export LANGFLOW_SUPERUSER=admin
# Enforce authenticated access at the proxy layer (example: nginx)
# location / { auth_request /_auth; proxy_pass http://127.0.0.1:7860; }