External risk intelligence

IBM Langflow OSS OS Command Execution via Crafted Flow Save.

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-19295

Langflow is a web-based application designed for building and deploying AI workflows and pipelines. These tools are commonly deployed as web interfaces or API services intended for user interaction, making it likely that the application is reachable via a network or public-facing deployment in many environments.

Privilege Escalation

Langflow

1.0.0 to before 1.11.2

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects IBM Langflow, a tool used for building and deploying AI workflows. An authenticated user could potentially execute unauthorized commands on the server, bypassing security controls. The main concern is confirming relevance and exposure within our environment.

Attackers can run any command on the server.
It allows unauthorized users to escalate privileges.
Confirm if Langflow is used and if it's exposed.

Attack Path

How an attacker could exploit the issue

An attacker with authenticated access could potentially gain control of the server by creating a specialized flow. When this crafted flow is used to build another flow, it allows the attacker to run commands on the server with the same permissions as the server's process. This bypasses a security setting designed to prevent custom code execution.

Requires authenticated access.
Triggered by saving and building a crafted flow.
Risk of arbitrary command execution.

Live Threat

Current exploitation, exposure, and threat context

An authenticated attacker could execute arbitrary operating system commands on the server running IBM Langflow OSS. This occurs when saving a flow with a crafted type field and triggering a build of a referenced wrapper flow, leading to privilege escalation from an authenticated flow user to OS-level command execution under the server's identity. This bypasses security policies designed to prevent custom component execution.

Arbitrary OS command execution.
Saving crafted flow, triggering build.
Server compromise, data theft.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability affects IBM Langflow OSS and requires immediate attention from teams responsible for application security and infrastructure. The first practical step is to identify all instances of the affected technology, determine their reachability and business criticality, and then locate the accountable owner. Remediation planning should be risk-based, prioritizing the most exposed and critical systems.

Application and infrastructure teams own this.
Verify affected system reachability and criticality.
Plan risk-based remediation with vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is IBM Langflow OSS?

IBM Langflow OSS is a web-based platform used to build, manage, and deploy AI workflows and data pipelines. It provides an interface for users to visually connect components and automate processing tasks. Because it serves as a central hub for orchestration, it is often deployed as a network-accessible service to allow multiple users to collaborate on and execute these automated workflows.

What does CWE-95 mean for CVE-2026-19295?

CWE-95 refers to Improper Neutralization of Directives in Dynamically Evaluated Code. In the context of this vulnerability, it means the application does not properly sanitize user-provided input before using it to execute commands. An attacker can supply a malicious, crafted type field that the server interprets as a command, effectively tricking the system into running unauthorized code.

How is this command execution vulnerability triggered?

The vulnerability is triggered when an authenticated user saves a flow containing a specially crafted type field and then initiates a build process for a wrapper flow that references that initial flow. It is important to note that simply having an account is not enough; the attacker must actively save the manipulated component and trigger the wrapper build. Standard, non-malicious use of the flow builder does not trigger this execution.

Is my IBM Langflow instance at risk?

According to Halo Surface Signal, Langflow instances are often deployed as web-facing or network-reachable services to support user interaction, which increases the likelihood of exposure. If your instance is accessible over a network where an authenticated attacker can reach the interface, the risk is elevated. You should prioritize internal systems that allow user access.

What should I do if I run IBM Langflow OSS?

First, perform an inventory to locate all running instances of IBM Langflow OSS within your environment. Verify who owns these systems and confirm their network accessibility. Once identified, evaluate the business criticality of each instance and coordinate with your security or infrastructure team to plan and apply the necessary patches provided by the vendor.

References

www.ibm.com/support/pages/node/7284733

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.