External risk intelligence

IBM Langflow OSS Python Code Execution Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-18894

Langflow is a low-code tool frequently deployed as a web-based application or service to facilitate AI workflow orchestration. These deployments are commonly exposed as web interfaces to allow users to build, test, and run workflows, making the application surface reachable from the network.

Code Injection

Langflow

1.0.0 to before 1.12.5

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in IBM Langflow OSS could allow an unauthorized remote attacker to execute pre-existing code within a public workflow, bypassing security restrictions. This could potentially lead to the execution of unintended code within the server process, impacting the integrity and availability of the system.

Uncontrolled code execution in public workflows.
Bypasses trust boundaries, affecting system integrity.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by targeting a public workflow in IBM Langflow OSS. Since no authentication is required, an attacker can send a request to a public workflow, which then executes pre-existing Python code. This code runs with the same permissions as the flow's owner on the server, potentially leading to severe compromise.

Remote attacker, no authentication needed.
Public workflow triggers stored Python code.
Code execution under flow owner's privileges.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated remote attacker to execute arbitrary Python code within the server's runtime context by triggering existing stored Python components in public workflows. This bypasses intended security restrictions, potentially affecting the confidentiality, integrity, and availability of the server process and any data it accesses.

Server-side code execution.
Unauthenticated remote code execution.
Compromise of server runtime and data.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and platform teams are likely responsible for managing IBM Langflow OSS, given its role in orchestrating AI workflows and its common deployment as a web-based service. The first practical step is to identify all instances of Langflow, confirm their network reachability and business criticality, and then determine the accountable owner to plan remediation based on the assessed risk.

Identify Langflow instances and ownership.
Verify network exposure and criticality.
Plan remediation with application owners.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is IBM Langflow OSS?

Langflow is an open-source, low-code platform designed for building, testing, and orchestrating AI workflows. It provides a visual interface that allows developers to connect various components and models, and it is frequently deployed as a web-based service to enable collaborative workflow development and execution.

How does CVE-2026-18894 cause a security risk?

This vulnerability is classified as CWE-94, or Improper Control of Generation of Code. In this specific case, it allows an attacker to trigger pre-existing Python code stored within a public workflow. Because the system fails to maintain the intended trust boundary, this code executes within the server's runtime environment, effectively bypassing security restrictions.

Can any workflow be used to trigger this vulnerability?

The issue specifically involves public workflows containing stored Python components. The vulnerability is not triggered by empty workflows or those that lack these specific pre-existing Python components, as the attacker relies on the pre-configured execution path within the workflow to perform the unauthorized action.

Is my instance of Langflow at risk?

If your Langflow instance is network-reachable, Halo Surface Signal identifies it as having an external classification because these tools are typically deployed as web-based interfaces. Instances exposed to the internet are at higher risk, as the vulnerability does not require authentication to reach the affected workflow components.

What is the first step to address this CVE?

Begin by creating an inventory of all Langflow instances within your environment. Once identified, determine which instances are network-accessible and verify their business criticality. Engage the owners of these specific workflows to assess the risk and prepare to apply the necessary updates to secure the server process.

References

www.ibm.com/support/pages/node/7293016

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.