CVE-2026-76059

Executive Summary

CVE-2026-76059 is a static analysis bypass in IBM Langflow OSS versions 1.0.0 through 1.11.5 that allows an authenticated attacker who can submit custom component source code to slip a dangerous callable past the platform's pre-execution security scanner. The scanner's alias-tracking logic fails to validate an annotated class-body assignment against the dangerous callable blocklist, so a crafted component that reaches the runtime execution path can execute arbitrary operating system commands in-process with the privileges of the Langflow service account. With a CVSS base score of 8.8 (High) and no patch, workaround, or public exploit currently available, the primary risk is to internet-exposed or multi-tenant Langflow deployments where untrusted users can author and run custom components.

Technical Analysis

Langflow is a low-code framework for building LLM and agentic AI flows, in which users compose applications from built-in and custom "components." Custom components are authored as Python source and, before execution, are passed through a static security scanner intended to block access to dangerous callables (the description refers to a "dangerous callable blocklist"). CVE-2026-76059 is classified as CWE-693 (Protection Mechanism Failure): the protection mechanism itself is defective, rather than a memory-safety or injection error.

The specific defect is a logic error in the scanner's alias-tracking mechanism. The scanner is designed to follow assignments so that a name or alias that eventually resolves to a blocklisted (dangerous) callable is denied. However, when the assignment takes the form of an annotated class-body assignment — an assignment inside a class body that carries an annotation — the resolved value is never checked against the dangerous callable blocklist. In effect, the alias tracking terminates early or skips the validation step for this syntactic form, so a value that does resolve to a dangerous callable is admitted.

The impact of the bypass is direct and severe: if the crafted component subsequently reaches the runtime execution path, the resolved dangerous callable is invoked in-process, allowing arbitrary operating system command execution with the privileges of the running Langflow service. Critically, the bypass is only a protection-mechanism failure; exploitation requires (a) the ability to submit custom component source code and (b) that the component be executed. The CVSS vector confirms this profile: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H — network-exploitable, low attack complexity, but requiring low-level privileges (an authenticated user with component-authoring/submission capability), with high confidentiality, integrity, and availability impact on the Langflow service host.

No CNA title, affected-package metadata, or vendor workaround was supplied with this record; the analysis above is limited strictly to the NVD description. No PoC, exploit code, or Nuclei template is publicly available, and CISA KEV does not list this CVE.

Exploitation Scenarios

Exploitation follows the standard chain for a static-analysis-bypass-to-RCE flaw. No public PoC exists; the following is inferred from the vulnerability class and the NVD description only.

1. Reconnaissance / target identification: The attacker identifies a reachable Langflow OSS instance (versions 1.0.0–1.11.5) where they can authenticate at a low privilege level and use the custom-component authoring/submission feature. Internet-exposed or multi-tenant deployments, or any environment in which component contributions from less-trusted users are accepted, are the highest-value targets.

2. Triggering the flaw class: The attacker authors a custom component and embeds an assignment inside a class body that carries an annotation. Because the static scanner's alias-tracking logic never validates the resolved value of that annotated class-body assignment against the dangerous callable blocklist, the scanner permits the component to pass. This is the protection-mechanism bypass; it is the only step of the chain that is specific to CVE-2026-76059.

3. Payload / execution method (at the vulnerability-class level): Having bypassed the scanner, the attacker ensures the crafted component reaches the runtime execution path (e.g., by building and running a flow that instantiates the component). At that point the alias that was never checked resolves to a dangerous callable, which is invoked in-process, resulting in arbitrary operating system command execution. The NVD description does not name the specific callable, the exact annotation syntax, or the exact flow-invocation step; these are deliberately not fabricated here.

4. Post-exploitation impact: Commands run with the privileges of the running Langflow service. Depending on deployment, that yields read/write access to flow definitions, credentials and secrets used by the AI pipeline, and any data reachable by the service account; potential lateral movement into connected model providers, vector stores, and internal networks; and full compromise of service integrity and availability (CVSS C:H/I:H/A:H).

Impact Assessment

Successful exploitation results in arbitrary OS command execution in-process on the Langflow server, at the privilege level of the service account. Business impact includes compromise of the AI application pipeline itself: exfiltration or tampering with prompt/flow definitions, model credentials, API keys held by the service, and any customer or internal data the service can reach. In multi-tenant or shared Langflow deployments, a low-privileged component author can pivot to host-level control, effectively breaking tenant isolation and turning the AI platform into an internal foothold. The CVSS subscores drive the urgency: AV:N (remotely reachable), AC:L (no race or special conditions beyond submitting/running the component), PR:L (authenticated, component-authoring privileges required), UI:N (no victim interaction beyond the service's normal execution of the component), S:U (impact scoped to the vulnerable component), C:H/I:H/A:H (total loss of confidentiality, integrity, and availability for the affected service). The EPSS score has not been published by FIRST.org, so no probabilistic exploitation forecast is available; CISA KEV does not include this CVE; and no public exploit increases the near-term likelihood of opportunistic attacks. The blast radius is bounded by whatever the Langflow service account can reach — in typical cloud AI deployments this can include metadata endpoints, model provider credentials, and internal data stores.

Detection Guidance

Because the exploit path is custom-component source submission and execution rather than a signatured network attack, detection must combine application-layer logging (component create/update and run events), content inspection of submitted source, and host-level process telemetry. No exploit code exists publicly, so detections below are geared to the vulnerability class (annotated class-body assignments resolving to dangerous callables; child processes spawned by the Langflow service) rather than to a known payload.

Sigma Rule

title: Potential Langflow Custom Component Scanner Bypass and In-Process Command Execution
id: 8f5a2c1e-7b64-4c3d-9e21-l4ngf10wrce
status: experimental
description: Detects suspicious child process execution originating from a Langflow service process, consistent with CVE-2026-76059 scanner bypass leading to in-process OS command execution.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-76059
author: valtersit.com Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1190
  - attack.execution
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/python3'
      - '/python'
      - '/uvicorn'
      - '/gunicorn'
  selection_service:
    ParentCommandLine|contains:
      - 'langflow'
      - 'langflow run'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/python3'
  condition: selection_parent and selection_service and selection_child
falsepositives:
  - Legitimate Langflow components that shell out for benign tooling
  - Administrative maintenance scripts run from the Langflow virtualenv
level: high

YARA Rule

rule Langflow_Annotated_ClassBody_Alias_Bypass_CVE_2026_76059
{
    meta:
        description = "Detects Langflow custom component source attempting to bypass the static scanner via annotated class-body assignments that resolve to dangerous callables (CVE-2026-76059)"
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-76059"
        date = "2026-01-01"
        severity = "high"
    strings:
        $class = "class " ascii
        $annotation = /\:\s*[A-Za-z_][A-Za-z0-9_\.\[\]]*\s*\=/ ascii
        $assign = "=" ascii
        $danger1 = "os.system" ascii
        $danger2 = "subprocess" ascii
        $danger3 = "popen" ascii
        $danger4 = "exec(" ascii
        $danger5 = "eval(" ascii
        $danger6 = "__import__" ascii
    condition:
        $class and $annotation and $assign and 1 of ($danger*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-76059 Possible Langflow Custom Component Submission with Annotated Class-Body Assignment"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"component"; nocase; http.request_body; content:"class "; distance:0; http.request_body; pcre:"/\\:\\s*[A-Za-z_][A-Za-z0-9_\\.\\[\\]]*\\s*=/"; http.request_body; content:"os.system"; nocase; distance:0; http.request_body; content:"subprocess"; nocase; distance:0; threshold:type limit, track by_src, count 5, seconds 60; reference:cve,CVE-2026-76059; classtype:web-application-attack; sid:76059101; rev:1;)

Note: The HTTP path fragment "component" above reflects the component-authoring feature described generically; exact routes are not enumerated in the NVD description and should be adjusted to the deployment's observed API surface.

Elastic Detection

process where event.type == "start" and
  process.parent.name in ("python3", "python", "uvicorn", "gunicorn") and
  process.parent.command_line != null and
  process.parent.command_line : "*langflow*" and
  process.name in ("sh", "bash", "dash", "curl", "wget", "nc", "ncat", "python3") and
  not process.command_line : ("*--check*", "*pip install*")

Splunk SPL Query

index=edr OR index=linux (sourcetype=auditd OR sourcetype=sysmon_linux OR sourcetype=process_creation)
(process_name=sh OR process_name=bash OR process_name=dash OR process_name=curl OR process_name=wget OR process_name=nc)
| rex field=parent_process "python.*langflow"
| search parent_process="*langflow*"
| table _time host user dest parent_process process_name process
| sort - _time

Wazuh OSSEC Rule

<group name="langflow,cve-2026-76059,">
  <rule id="760591" level="12">
    <decoded_as>json</decoded_as>
    <field name="parentImage">\.*(python3|python|uvicorn|gunicorn)$</field>
    <field name="parentCommandLine">(?i)langflow</field>
    <field name="image">\.*(sh|bash|dash|curl|wget|nc|ncat)$</field>
    <description>CVE-2026-76059: suspicious child process spawned by Langflow service - possible scanner bypass RCE</description>
    <mitre>
      <id>T1190</id>
      <id>T1059</id>
    </mitre>
    <group>process_creation,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No fixed version, vendor advisory, or official workaround has been published for CVE-2026-76059 as of this report.

1. Immediate mitigations (compensating controls):

• Restrict who can author, submit, or publish custom components in Langflow; treat component-authoring privileges as equivalent to host-level code execution privileges.
• Do not expose Langflow 1.0.0–1.11.5 directly to the internet. Place it behind an authenticated reverse proxy, VPN, or zero-trust access layer, and rate-limit/alert on component submission.
• In multi-tenant deployments, isolate Langflow in a container/sandbox with no host mounts, minimal network egress (block access to cloud metadata endpoints), and a dedicated low-privilege service account. Seccomp/AppArmor profiles that deny subprocess creation add defense in depth.
• Disable or restrict custom-component execution entirely if the business does not require third-party component authoring.
• Monitor the detections in the previous section for child processes spawned from the Langflow service.

2. Patch / upgrade steps:

• There is currently no patch. Track IBM's security bulletins and the upstream Langflow project for a fixed release beyond 1.11.5, and plan to upgrade immediately once available. Until then, apply the compensating controls above.

3. Long-term hardening:

• Move custom-code validation to a true sandbox/allowlist model (e.g., restricted AST/bytecode evaluation in a seccomp-isolated worker) rather than an alias-tracking blocklist, and add regression tests covering annotated class-body assignments.
• Enforce least privilege on the Langflow service account; rotate all secrets and API keys the service can access.
• Integrate SAST/static-review checks for submitted components into CI, and log all component submissions for retro-hunting.

References

1. NVD — CVE-2026-76059: https://nvd.nist.gov/vuln/detail/CVE-2026-76059
2. CWE-693 — Protection Mechanism Failure: https://cwe.mitre.org/data/definitions/693.html
3. MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
4. IBM Security Bulletins (monitor for Langflow OSS advisory covering 1.0.0–1.11.5): https://www.ibm.com/support/pages/security-bulletins
5. CISA KEV Catalog (CVE-2026-76059 not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor and exploit-in-the-wild status: No known campaigns, no public PoC, no exploit code, and no KEV listing exist for CVE-2026-76059 at the time of writing. EPSS has not been scored by FIRST.org.