CVE-2026-8182: IBM Langflow OSS RCE Vulnerability

CVE-2026-8182 Overview

CVE-2026-8182 is a remote code execution vulnerability affecting IBM Langflow OSS versions 1.0.0 through 1.10.3. The flaw allows remote attackers to execute arbitrary code on affected servers using only two HTTP requests. IBM classifies the issue under improper control of code generation [CWE-94]. The vulnerability is network-exploitable with low attack complexity, exposing any internet-facing Langflow instance to compromise. Successful exploitation grants attackers full control over the server process, threatening the confidentiality, integrity, and availability of hosted AI workflows and connected data sources.

Critical Impact
Attackers on the internet can execute arbitrary code on unpatched Langflow OSS servers using two HTTP requests, leading to full server compromise.

Affected Products

IBM Langflow OSS 1.0.0 through 1.10.3
Self-hosted Langflow deployments exposed to untrusted networks
Downstream AI pipelines and connected data stores integrated with Langflow

Discovery Timeline

2026-08-05 - CVE-2026-8182 published to the National Vulnerability Database
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-8182

Vulnerability Analysis

CVE-2026-8182 is a code injection vulnerability [CWE-94] in IBM Langflow OSS, an open-source framework for building AI agent workflows. The flaw resides in server-side endpoints that accept and evaluate user-controlled input as executable code. Attackers reach the vulnerable code path with two HTTP requests to an exposed Langflow instance. The condition affects every release from 1.0.0 to 1.10.3, indicating the weakness is present in long-lived functionality rather than a recent regression. Because Langflow orchestrates AI pipelines, a compromised server exposes model credentials, prompt data, and connected backends.

Root Cause

The vulnerability stems from improper control over dynamic code generation on server-side components. Langflow evaluates attacker-controlled payloads without adequate sandboxing or input validation. Code passed through the affected HTTP handlers reaches an execution primitive that runs in the context of the Langflow process. IBM's advisory identifies the weakness as CWE-94: Improper Control of Generation of Code.

Attack Vector

Exploitation is remote and requires only network access to the Langflow HTTP interface. An attacker sends two crafted HTTP requests that reach the vulnerable code-generation endpoint and trigger arbitrary code execution. The Langflow process typically runs with permissions to reach model providers, vector stores, and internal services, so successful exploitation enables lateral movement and data exfiltration. Refer to the IBM Security Advisory for technical details on the affected endpoints.

// No verified public exploit code is available at time of writing.
// See the IBM Security Advisory for technical details on the affected code paths.

Detection Methods for CVE-2026-8182

Indicators of Compromise

Unexpected child processes spawned by the Langflow server process, such as shell interpreters, python, or curl.
Outbound network connections from the Langflow host to unfamiliar IP addresses or paste sites.
New or modified files in Langflow working directories, particularly scripts or web shells.
HTTP access logs showing paired requests to code-generation or flow-execution endpoints from a single source in rapid succession.

Detection Strategies

Inspect Langflow application logs for anomalous flow-execution requests originating from untrusted networks.
Correlate reverse proxy or WAF telemetry with process-execution events on the Langflow host to identify request-driven command execution.
Baseline normal Langflow subprocess activity and alert on deviations such as spawned shells or interpreters.

Monitoring Recommendations

Forward Langflow, reverse proxy, and host process telemetry into a centralized analytics platform for correlation.
Alert on outbound connections from the Langflow service account to non-approved destinations.
Monitor for repeated authentication or endpoint enumeration attempts against Langflow HTTP interfaces from a single source.

How to Mitigate CVE-2026-8182

Immediate Actions Required

Upgrade IBM Langflow OSS to a version later than 1.10.3 as directed in the IBM Security Advisory.
Remove direct internet exposure of Langflow instances and place them behind an authenticated reverse proxy or VPN.
Rotate any API keys, model provider credentials, and database secrets accessible to the Langflow process.
Audit Langflow hosts for signs of prior exploitation before returning them to service.

Patch Information

IBM has published remediation guidance in the IBM Security Advisory. Administrators should apply the fixed release identified by IBM and validate that all Langflow instances, including containerized deployments and forks, have been updated. Versions 1.0.0 through 1.10.3 remain vulnerable until upgraded.

Workarounds

Restrict network access to Langflow with firewall rules or security groups that limit connections to trusted administrators.
Enforce authentication at an upstream proxy and disable anonymous access to Langflow HTTP endpoints.
Run the Langflow process as an unprivileged user in an isolated container with egress filtering to reduce blast radius.

bash

# Example: restrict Langflow exposure with an nftables rule
nft add rule inet filter input tcp dport 7860 ip saddr != 10.0.0.0/24 drop