CVE-2026-19286: Langflow RCE Vulnerability

CVE-2026-19286 Overview

IBM Langflow OSS versions 1.0.0 through 1.11.1 contain a remote code execution vulnerability in the Agent2Agent (A2A) public endpoint. The endpoint fails to enforce security restrictions, allowing unauthenticated remote attackers to execute arbitrary code on affected systems. The flaw is tracked under CWE-94: Improper Control of Generation of Code.

Langflow is a widely deployed low-code framework for building agentic AI workflows and LLM applications. Exposure of the A2A endpoint on internet-facing deployments places the underlying host at direct risk of takeover.

Critical Impact
Unauthenticated remote attackers can execute arbitrary code on Langflow servers, leading to full compromise of the host and any connected AI pipelines, credentials, and data.

Affected Products

IBM Langflow OSS 1.0.0
IBM Langflow OSS versions 1.0.1 through 1.11.0
IBM Langflow OSS 1.11.1

Discovery Timeline

2026-08-28 - CVE-2026-19286 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-19286

Vulnerability Analysis

The vulnerability affects the A2A (Agent2Agent) public endpoint in Langflow. Langflow exposes this endpoint to enable inter-agent communication between orchestrated LLM components. Improper enforcement of security restrictions on this route allows a remote attacker to submit crafted requests that reach code-generation or code-execution paths without authentication.

Because the endpoint is public by design, an attacker requires only network reachability to the Langflow instance. No user interaction and no prior credentials are needed. Successful exploitation grants arbitrary code execution in the context of the Langflow process, which typically has access to model API keys, vector store credentials, and any mounted secrets.

The EPSS score is 0.617% with a percentile of 47.2, indicating measurable exploitation interest for a newly disclosed flaw. IBM has published guidance through its support portal.

Root Cause

The root cause is improper control of generation of code [CWE-94] on the A2A public endpoint. Security restrictions that gate access to sensitive execution primitives are not correctly enforced. Input received by the endpoint reaches a code interpretation or generation pathway, allowing attacker-controlled logic to run inside the Langflow runtime.

Attack Vector

The attack vector is network-based. An attacker sends a crafted HTTP request to the exposed A2A endpoint on a vulnerable Langflow instance. The malicious payload triggers the code injection path, producing arbitrary execution on the server. Because Langflow is commonly deployed in containers with elevated permissions to reach external AI services, post-exploitation typically includes credential theft, lateral movement to model providers, and pivoting into internal networks.

No verified public exploit code is available at the time of publication. See the IBM Support advisory for vendor-specific technical details.

Detection Methods for CVE-2026-19286

Indicators of Compromise

Unexpected outbound network connections originating from the Langflow process or container.
New or modified Python files, shell scripts, or cron entries within the Langflow working directory.
HTTP POST traffic to A2A endpoint paths from unrecognized source IPs, particularly with large or encoded payloads.
Spawning of shell interpreters (/bin/sh, bash, python -c) as child processes of the Langflow application.

Detection Strategies

Inspect web server and reverse proxy logs for requests targeting the A2A endpoint from external addresses.
Baseline the Langflow process tree and alert on any deviation, especially spawning of interpreters or network utilities.
Correlate authentication logs with A2A endpoint activity to identify unauthenticated calls reaching sensitive routes.

Monitoring Recommendations

Enable verbose access logging on the Langflow HTTP listener and forward logs to a centralized SIEM.
Monitor Langflow container filesystem writes and outbound DNS or HTTP requests to unfamiliar destinations.
Track egress traffic to public paste sites, cryptomining pools, and cloud metadata endpoints from Langflow hosts.

How to Mitigate CVE-2026-19286

Immediate Actions Required

Upgrade IBM Langflow OSS to a fixed version above 1.11.1 as directed in the IBM Support advisory.
Remove Langflow instances from direct internet exposure until patching is complete.
Rotate all API keys, model provider credentials, and secrets stored in or accessible by Langflow.
Review Langflow host and container logs for indicators of prior exploitation.

Patch Information

IBM has published remediation guidance on the IBM Support Page for Langflow OSS. Apply the vendor-supplied fixed release for versions 1.0.0 through 1.11.1. Verify the running build after upgrade and restart the service to ensure the vulnerable A2A handler is no longer loaded.

Workarounds

Place Langflow behind an authenticating reverse proxy that blocks anonymous requests to the A2A endpoint.
Restrict inbound network access to Langflow using firewall rules or service mesh policies that allow only trusted internal clients.
Disable or gate the A2A endpoint at the ingress layer if agent-to-agent functionality is not required.
Run Langflow as a least-privileged user in a hardened container with read-only filesystem and no outbound access beyond required AI service endpoints.

bash

# Example: block external access to the A2A endpoint at an nginx reverse proxy
location /api/v1/a2a/ {
    allow 10.0.0.0/8;
    deny  all;
    proxy_pass http://langflow_upstream;
}