CVE-2026-97676: IBM Langflow OSS RCE Vulnerability

CVE-2026-97676 Overview

CVE-2026-97676 is a sandbox escape vulnerability in IBM Langflow OSS versions 1.0.0 through 1.12.2. The flaw allows a remote authenticated attacker to execute arbitrary code on the host running Langflow. The weakness stems from improper neutralization of special elements used in code [CWE-94], enabling injected code to break out of the restricted execution context. Successful exploitation grants attacker-controlled code execution with the privileges of the Langflow process, impacting confidentiality, integrity, and availability of the affected system.

Critical Impact

Authenticated attackers can escape the Langflow code sandbox and execute arbitrary code on the host, leading to full compromise of the application environment.

Affected Products

• IBM Langflow OSS 1.0.0 through 1.12.2
• Deployments exposing the Langflow user interface or API to authenticated users
• Hosted and self-managed Langflow instances within the affected version range

Discovery Timeline

• 2026-10-07 - CVE-2026-97676 published to the National Vulnerability Database (NVD)
• 2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-97676

Vulnerability Analysis

Langflow is a visual framework for building applications on top of large language models. It accepts user-authored Python expressions and components, which are intended to execute inside a restricted sandbox. CVE-2026-97676 arises because Langflow fails to adequately neutralize special syntactic elements before passing user input into the execution pipeline. An authenticated attacker can craft input that bypasses the sandbox boundary and reaches the underlying Python interpreter. Because the attack vector is network accessible and only requires low-privileged authentication, any user with workflow authoring access can abuse the flaw.

Root Cause

The root cause is classified as Improper Control of Generation of Code [CWE-94]. Langflow's input handling does not sufficiently sanitize or restrict syntactic constructs that influence how code is parsed and executed. Attacker-supplied constructs are interpreted by the runtime rather than treated as inert data, which collapses the trust boundary between user-supplied flow definitions and server-side code execution.

Attack Vector

An attacker authenticates to the Langflow interface or API, then submits a crafted component, flow definition, or expression that embeds code constructs designed to escape the sandbox. When Langflow evaluates the input, the injected code runs with the privileges of the Langflow service account. From that foothold, an attacker can read secrets, pivot to connected model providers and databases, modify flows, or stage further intrusion. Full technical details are available in the IBM Security Support Page. No public exploit code or proof-of-concept is currently published.

Detection Methods for CVE-2026-97676

Indicators of Compromise

• Langflow worker processes spawning unexpected child processes such as sh, bash, curl, or python outside the normal flow execution pattern.
• Outbound network connections from the Langflow host to unfamiliar domains or IP addresses shortly after flow submission.
• New or modified flow definitions containing unusual Python attribute access patterns, dunder references, or import constructs intended to escape the sandbox.

Detection Strategies

• Monitor Langflow application logs for flow creation and execution events submitted by low-privileged accounts, correlated with subsequent process or file system activity.
• Baseline the normal process tree of the Langflow service and alert on deviations, particularly interpreter or shell invocations with network-related arguments.
• Inspect submitted components and expressions for suspicious tokens such as __class__, __subclasses__, __globals__, __import__, or builtins references.

Monitoring Recommendations

• Enable verbose audit logging for Langflow authentication, flow creation, and component execution endpoints, then forward events to a central analytics platform.
• Instrument the host with runtime telemetry to capture process lineage, file writes, and outbound network connections originating from the Langflow service.
• Review user accounts with authoring privileges and alert on new or dormant accounts that begin submitting flows containing dynamic code.

How to Mitigate CVE-2026-97676

Immediate Actions Required

• Upgrade IBM Langflow OSS to a fixed release above 1.12.2 as published on the IBM Security Support Page.
• Restrict network exposure of Langflow to trusted users and place the service behind an authenticated reverse proxy or VPN.
• Audit existing user accounts and remove authoring privileges from accounts that do not require them.

Patch Information

IBM has published remediation guidance on the IBM Security Support Page. Administrators should review the advisory for the specific fixed version and upgrade path applicable to their deployment, then verify the installed version after patching.

Workarounds

• Disable or block flow authoring endpoints for non-administrative users until the upgrade is completed.
• Run the Langflow service as an unprivileged user inside a hardened container with read-only file system, dropped Linux capabilities, and strict egress network policies.
• Review and remove untrusted flow definitions and custom components submitted by non-trusted users before executing them in a patched environment.

# Example container hardening for Langflow
docker run -d \
  --name langflow \
  --read-only \
  --cap-drop ALL \
  --security-opt no-new-privileges \
  --user 10001:10001 \
  --network langflow-restricted \
  --tmpfs /tmp:rw,noexec,nosuid,size=64m \
  langflowai/langflow:latest