CVE-2026-97674: IBM Langflow OSS RCE Vulnerability

CVE-2026-97674 Overview

CVE-2026-97674 affects IBM Langflow OSS versions 1.0.0 through 1.12.2. The vulnerability allows a remote authenticated attacker to execute arbitrary operating system commands on the host running Langflow. It stems from improper neutralization of special elements in OS commands, categorized under [CWE-94] improper control of code generation. Successful exploitation requires network access and low-privilege authentication, with no user interaction needed.

Critical Impact

An authenticated remote attacker can execute arbitrary OS commands on the Langflow host, leading to full compromise of confidentiality and integrity of the application environment.

Affected Products

• IBM Langflow OSS 1.0.0
• IBM Langflow OSS versions 1.0.1 through 1.12.1
• IBM Langflow OSS 1.12.2

Discovery Timeline

• 2026-10-07 - CVE-2026-97674 published to NVD
• 2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-97674

Vulnerability Analysis

IBM Langflow OSS is an open-source framework for building language model applications through a visual flow-based interface. The affected versions fail to properly neutralize special characters passed into code generation and execution paths. An authenticated user with network access to the Langflow service can inject payloads that the application interprets as executable code or shell commands.

The weakness is tracked under [CWE-94] Improper Control of Generation of Code. The vulnerability spans a wide release range (1.0.0 through 1.12.2), indicating the unsafe code-generation pattern has been present throughout the OSS branch. Exploitation does not require elevated privileges, only an authenticated session.

Root Cause

The root cause is improper neutralization of special elements used in an OS command. Langflow accepts user-supplied input that flows into a code-generation or execution routine without adequate sanitization or sandboxing. The application constructs code or shell commands from attacker-controlled data and executes them in the server context.

Attack Vector

The attack vector is network-based. An attacker with valid credentials sends crafted input through Langflow endpoints or flow components that process code or expressions. The injected payload is incorporated into generated code and executed by the Langflow runtime, resulting in arbitrary OS command execution under the privileges of the Langflow process.

No verified proof-of-concept code is published for this issue. Refer to the IBM Support Page for Node 7290694 for vendor-authoritative technical detail.

Detection Methods for CVE-2026-97674

Indicators of Compromise

• Unexpected child processes spawned by the Langflow server process, especially shells such as /bin/sh, bash, or cmd.exe.
• Outbound network connections from the Langflow host to unknown or non-approved destinations.
• New or modified files in Langflow working directories, including scripts, binaries, or scheduled task entries.
• Authenticated API requests containing shell metacharacters, Python exec/eval constructs, or encoded payloads in flow-definition fields.

Detection Strategies

• Correlate authenticated Langflow session activity with process-creation events on the host to identify command execution originating from the application process tree.
• Alert on Langflow API requests whose payloads contain known code-execution primitives such as subprocess, os.system, backticks, or __import__.
• Review Langflow audit logs for flow modifications and component executions performed by low-privilege accounts.

Monitoring Recommendations

• Enable verbose application logging on Langflow endpoints that accept flow components and code expressions.
• Ingest Langflow host telemetry including process, file, and network events into a centralized analytics platform for correlation.
• Baseline normal Langflow process behavior and alert on deviations such as unexpected interpreter invocations or outbound traffic.

How to Mitigate CVE-2026-97674

Immediate Actions Required

• Upgrade IBM Langflow OSS to a fixed version as directed in the IBM Support Page for Node 7290694.
• Restrict network access to the Langflow service to trusted administrative networks until patching is complete.
• Audit all Langflow user accounts and revoke credentials that are not required for operations.
• Rotate any secrets, API keys, or tokens accessible to the Langflow process if compromise is suspected.

Patch Information

IBM has published remediation guidance for CVE-2026-97674 on the IBM Support Page for Node 7290694. Administrators should consult the advisory for the exact fixed version and upgrade procedure for IBM Langflow OSS deployments running 1.0.0 through 1.12.2.

Workarounds

• Place Langflow behind an authenticating reverse proxy and enforce strong, unique credentials with multi-factor authentication where supported.
• Run the Langflow process as a dedicated, unprivileged service account with the minimum file system and network permissions required.
• Deploy Langflow inside a container or sandbox with restricted syscalls, read-only root filesystem, and egress filtering to limit the impact of command execution.
• Disable or restrict flow components that permit arbitrary code or shell execution to a small set of trusted operators.

# Example hardening: run Langflow in a restricted container with egress controls
docker run --rm \
  --name langflow \
  --user 10001:10001 \
  --read-only \
  --cap-drop=ALL \
  --security-opt=no-new-privileges \
  --network=langflow-restricted \
  -p 127.0.0.1:7860:7860 \
  langflowai/langflow:<patched-version>