CVE-2026-78571

Executive Summary

CVE-2026-78571 is a remote code execution vulnerability in IBM Langflow OSS versions 1.0.0 through 1.11.5, caused by an unguarded eval() call operating on attacker-controlled input. A remote attacker who holds valid authenticated credentials can supply crafted input that is passed directly into eval(), resulting in arbitrary Python code execution in the context of the Langflow application process. The vulnerability carries a CVSS 3.1 base score of 8.8 (High) with full confidentiality, integrity, and availability impact; no public proof-of-concept, exploit code, or Nuclei template exists at the time of writing, and no vendor patch has been confirmed.

Technical Analysis

The root cause is classified under CWE-94, Improper Control of Generation of Code ("Code Injection"). Per the NVD description, Langflow OSS 1.0.0 through 1.11.5 contains an unguarded eval() call that processes attacker-controlled input. The eval() built-in in Python parses and executes an arbitrary expression supplied as a string within the current interpreter context. When such a string is derived from external input and is not constrained by a sandbox, allow-list, or AST validation, the interpreter will execute attacker-supplied expressions with the privileges of the running Langflow process.

Several characteristics of this flaw are directly derivable from the provided intelligence:

• Attack vector (AV:N): exploitation is possible over the network, meaning the vulnerable code path is reachable through Langflow's remotely accessible interfaces rather than requiring local access.
• Privileges required (PR:L): the attacker must be authenticated. This distinguishes it from an unauthenticated RCE; a valid low-privileged account is sufficient. This raises the threat level for multi-tenant Langflow deployments where users are provisioned with standard accounts, and for internet-facing instances exposed with default or self-registration credentials.
• User interaction (UI:N): no victim action is needed; the attacker drives the request directly.
• Scope (S:U): impact is confined to the Langflow application's security authority, though code that executes under eval() retains the full privileges of the application process (filesystem, network, environment variables, and any credentials or API keys the instance holds).
• C/I/A (H:H:H): complete loss of confidentiality, integrity, and availability of the affected component.

Langflow is a low-code / visual framework for building agentic and LLM-powered flows. Such platforms inherently accept user-constructed expressions, component definitions, and dynamic logic that are compiled or evaluated at runtime. That design model creates a broad attack surface: any code path where a flow definition, component property, or user-supplied expression is passed to eval() without strict input validation is a candidate trigger point. The description does not identify the exact endpoint, component, or parameter that carries the tainted input, so the specific injection point cannot be confirmed from available data. The vulnerability class, however, is unambiguous: unvalidated code evaluation of externally supplied strings.

The CVSS temporal and environmental scores are not published, and FIRST.org has not yet assigned an EPSS score. There is no CISA KEV listing and no observed exploitation data in the provided intelligence. Absence of a PoC should not be interpreted as absence of risk — the vulnerability is trivially reachable by any authenticated user and executes with application-process privileges.

Exploitation Scenarios

The following attack chain is inferred from the vulnerability class (unguarded eval() on attacker-controlled input) and the CVSS vector. Because no PoC, endpoint name, or parameter name is available in the provided intelligence, the chain is described at the vulnerability-class level. No function names, API paths, or parameters are fabricated.

1. Reconnaissance / target identification. The attacker identifies an internet- or intranet-exposed Langflow OSS instance running a version between 1.0.0 and 1.11.5. Fingerprinting can rely on default HTTP responses, page titles, or the typical application port (commonly 7860 for Langflow deployments). Version disclosure may come from response headers, the web UI, or public metadata. The attacker also enumerates whether self-registration is enabled or whether valid credentials can be obtained or guessed.

2. Authentication / access acquisition. Per PR:L, the attacker must first obtain a valid session. This may be achieved through legitimate provisioning, a low-privileged account, credential reuse, or tenant access on a shared deployment. This step is a precondition, not part of the code-injection flaw itself.

3. Triggering the flaw class. With an authenticated session, the attacker supplies input to a Langflow feature that evaluates user-provided expressions via eval(). The crafted input is a string that the interpreter will parse and execute. Because the call is described as unguarded, there is no preprocessing that would prevent evaluation of arbitrary expressions. The attacker does not need to exploit a memory-safety bug or bypass a sandbox — they merely need to route their string into the vulnerable evaluation point.

4. Payload / execution. The submitted expression is evaluated by Python's eval() in the Langflow process context. At the vulnerability-class level, the payload is a Python expression that performs arbitrary operations available to an eval() call — for example, system command execution, file read/write, outbound network access, or retrieval of environment-resident secrets. The exact expression and surrounding syntax are not specified in the provided data and are therefore not reproduced here.

5. Post-exploitation impact. Successful execution yields code execution under the Langflow service account. Depending on deployment configuration, this can expose LLM API keys, database credentials, and other secrets held by the process, allow lateral movement within the internal network, permit persistent modification of flows or configuration, and cause full loss of availability of the instance. The CVSS impact subscores (C:H/I:H/A:H) reflect this complete compromise of the affected component.

No public exploit code, Nuclei template, or threat-actor campaign associated with CVE-2026-78571 is known from the provided intelligence.

Impact Assessment

CVE-2026-78571 is rated 8.8 (High) under CVSS 3.1. The subscores indicate: network-reachable (AV:N), low complexity (AC:L), authenticated access required (PR:L), no user interaction (UI:N), scope unchanged (S:U), and high impact to confidentiality, integrity, and availability.

Business impact is significant for any organization running Langflow OSS in the affected version range. Langflow instances frequently serve as orchestration hubs for LLM workflows and commonly hold sensitive API credentials for external model providers, internal data stores, and messaging or agent tooling. A single authenticated user achieving RCE can pivot from an application-level compromise to full control of the host process and, in poorly segmented deployments, to adjacent systems.

Blast radius considerations:

• Internet-facing deployments with self-registration enabled effectively lower the practical barrier from "authenticated insider" to "anonymous internet attacker with an account," substantially elevating real-world risk.
• Multi-tenant and shared instances allow one tenant to compromise the entire service and all co-tenant data and secrets.
• Internal deployments are still exposed to any authenticated user, including compromised low-privilege accounts, making this an attractive post-authentication escalation primitive.
• Because the vulnerability class yields arbitrary code execution, the affected system should be treated as fully compromised upon successful exploitation; rotating all secrets resident in or reachable from the instance is warranted.

There is currently no CISA KEV listing and no FIRST.org EPSS score available. These should be re-checked as advisories are published.

Detection Guidance

The following detections target the generic signature of code-injection-via-eval behavior in Langflow traffic and process activity. Because no exact endpoint, parameter, or payload is documented, rules focus on suspicious evaluable content, Langflow process spawning child processes, and anomalous outbound connections from the Langflow service.

Sigma Rule

title: Potential Langflow eval() Code Injection - Suspicious Child Process
id: 5f4d9a2c-7e21-4c8b-9a3f-1b2c3d4e5f60
status: experimental
description: Detects suspicious process creation from a Langflow (Python) process consistent with RCE via unguarded eval() (CVE-2026-78571)
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-78571
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1190
  - attack.execution
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/python'
      - '/python3'
      - '/langflow'
    ParentCommandLine|contains:
      - 'langflow'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/nc'
      - '/ncat'
      - '/curl'
      - '/wget'
      - '/python'
      - '/python3'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate Langflow components invoking shell tooling
level: high

YARA Rule

rule CVE_2026_78571_Langflow_Eval_Injection
{
    meta:
        author = "valtersit.com"
        description = "Detects suspicious eval/exec payload markers in Langflow request artifacts and logs (CVE-2026-78571)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-78571"
        date = "2026-01-01"
        severity = "high"

    strings:
        $s1 = "eval(" ascii nocase
        $s2 = "__import__" ascii
        $s3 = "os.system" ascii
        $s4 = "subprocess" ascii
        $s5 = "Popen" ascii
        $s6 = "base64" ascii nocase
        $s7 = "compile(" ascii
        $s8 = "/bin/sh" ascii
        $s9 = "langflow" ascii nocase

    condition:
        $s9 and 2 of ($s1, $s2, $s3, $s4, $s5, $s6, $s7, $s8)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-78571 Langflow Potential eval() Code Injection Attempt"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"eval("; nocase; http.request_body; content:"__import__"; nocase; distance:0; within:200; classtype:web-application-attack; reference:cve,2026-78571; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-78571; sid:202678571; rev:1;)

Elastic Detection

process where event.type == "start" and
  process.parent.name in ("python", "python3", "langflow") and
  process.parent.command_line : "*langflow*" and
  process.name in ("sh", "bash", "dash", "nc", "ncat", "curl", "wget", "python", "python3")

Splunk SPL Query

index=langflow OR index=web
| search (uri_path="*" AND (request_body="*eval(*" OR request_body="*__import__*" OR request_body="*subprocess*" OR request_body="*os.system*"))
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, user, uri_path, http_user_agent
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="langflow,cve-2026-78571,">
  <rule id="100571" level="12">
    <decoded_as>json</decoded_as>
    <field name="parent_process">langflow</field>
    <field name="command">\.(eval|__import__|os.system|subprocess|Popen)</field>
    <description>CVE-2026-78571: Suspicious code evaluation payload related to Langflow eval() RCE</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>

  <rule id="100572" level="14">
    <if_sid>100571</if_sid>
    <field name="command">(/bin/sh|/bin/bash|nc |ncat |curl |wget )</field>
    <description>CVE-2026-78571: Possible Langflow RCE - shell/network utility spawned by evaluated payload</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4 — UNPATCHED. No vendor fix, workaround, or affected-package advisory is available in any tracked source. Treat all Langflow OSS versions 1.0.0 through 1.11.5 as vulnerable.

1. Immediate mitigations

   • Restrict network access to Langflow instances. Do not expose Langflow directly to the internet; place it behind an authenticated reverse proxy and/or VPN.
   • Disable self-registration and enforce least-privilege accounts. Because PR:L requires authentication, reducing the number of accounts with access reduces exposure.
   • Isolate the Langflow service in a container or VM with minimal privileges: read-only filesystem where feasible, no host network access, no mounting of sensitive host paths, and restricted outbound egress.
   • Remove or rotate secrets (LLM API keys, database credentials, tokens) from the Langflow environment and host; assume compromise if suspicious evaluation activity is detected.
   • Monitor Langflow process behavior for child processes and anomalous network connections (see detection rules).

2. Patch / upgrade steps

   • No fixed version has been confirmed. Monitor the IBM Langflow OSS advisory channels and the NVD entry for a patched release. Do not assume upgrading within or above 1.11.5 is sufficient until a fixed version is explicitly published.
   • When a patched version is released, validate it in a staging environment, confirm the affected code path is removed or guarded, and roll out promptly.

3. Long-term hardening

   • Eliminate unguarded eval()/exec() on user input in any self-developed or forked code; replace with AST-validated evaluation, allow-lists, or safe expression libraries.
   • Implement capability sandboxing and least-privilege service accounts for all AI/LLM orchestration platforms.
   • Adopt a vulnerability management process that tracks AI/agentic framework CVEs and re-evaluates EPSS and KEV status when scoring becomes available.
   • Enforce egress filtering and network segmentation so that even a successful RCE cannot trivially reach internal systems.

References

• NVD — CVE-2026-78571: https://nvd.nist.gov/vuln/detail/CVE-2026-78571
• MITRE CWE-94 — Improper Control of Generation of Code: https://cwe.mitre.org/data/definitions/94.html
• FIRST.org EPSS (no score assigned as of report date): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• IBM Security advisories and Langflow OSS project releases (monitor for fixed version): https://www.ibm.com/support/pages/security-bulletins

No known threat-actor campaign or exploit-in-the-wild evidence is associated with CVE-2026-78571 in the provided intelligence. No public PoC, exploit code, or Nuclei template is available.