CVE-2026-79742

Executive Summary

CVE-2026-79742 is a remote code execution vulnerability in IBM Langflow OSS versions 1.0.0 through 1.11.5, rated CVSS 8.8. The flaw resides in an incomplete environment variable blocklist, allowing an authenticated remote attacker to bypass input filtering and execute arbitrary code. A publicly reachable Langflow instance with any valid low-privilege account is exposed to full host compromise; no patch exists per tracked sources, and no public PoC or KEV listing has been observed at time of writing.

Technical Analysis

The NVD description states the vulnerability is caused by an incomplete environment variable blocklist. CWE-94 (Improper Control of Generation of Code / Code Injection) confirms the root weakness is code-generation injection rather than memory corruption or a logic flaw in authentication.

Langflow is a low-code visual framework for building LLM/AI agent flows. Such platforms routinely accept user-supplied configuration — including environment variables passed to components, tool integrations, or sandboxed execution nodes — and instantiate processes, subprocesses, or dynamic interpreters from those values. A blocklist-based filter for environment variables is a denylist mechanism: it enumerates "dangerous" variable names and rejects them. Denylists of this kind are structurally fragile because they can only reject keys the developer anticipated. Any environment variable not enumerated — or an alternate spelling, casing variant, encoding, or indirection not covered by the filter — passes validation and is propagated into an execution context.

Because the precise enumerated blocklist entries, the components that consume environment variables, and the execution sink are not disclosed in the NVD description or CNA title, the following must be stated explicitly rather than fabricated:

• The specific environment variable names blocked or bypassed are unknown from available data.
• The specific Langflow component, node, or API endpoint that accepts the environment variable is not disclosed.
• The exact code path from accepted variable to arbitrary execution is not described in available data and must not be invented.

What can be stated with confidence from the record:

1. The attack requires network reachability (AV:N) and low-level authentication (PR:L) — i.e., any account suffices; the flaw is not gated behind admin rights.
2. The weakness is in an environment-variable validation control, indicating the vulnerable surface is wherever Langflow ingests env-var key/value pairs from an authenticated request and passes them downstream.
3. Success yields High confidentiality, integrity, and availability impact (C:H/I:H/A:H), consistent with OS-level command execution in the Langflow process context — typically a Python/container runtime with network access to backend model providers, databases, and internal services.
4. The CVSS temporal and environmental contexts are unmodified; exploitability is rated Low complexity (AC:L) and no user interaction (UI:N), meaning a skilled attacker needs no victim cooperation once authenticated.

EPSS has not scored this CVE by FIRST.org; no EPSS value is asserted here. CISA KEV status: NO. No public PoC, no Nuclei template, and no exploit code are tracked.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the vulnerability class (CWE-94 via incomplete env-var blocklist) and the CVSS parameters. Specific variable names, endpoints, and payloads are deliberately not fabricated.

1. Reconnaissance / target identification. An attacker enumerates internet-exposed Langflow deployments. Observed service fingerprints (web UI titled "Langflow", distinctive static assets, Langflow favicon hash) identify candidate hosts. Version disclosure — via UI footer, response headers, or dependency manifests — narrows targets to the affected range 1.0.0–1.11.5. The attacker then must obtain any authenticated session: a low-privilege account, a leaked/shared credential, or self-registration if enabled.

2. Triggering the specific flaw class. With an authenticated session, the attacker submits an environment-variable definition through a Langflow feature that accepts user-supplied variables (e.g., a flow/component configuration field, a build or execution configuration, or an environment/settings object — the exact feature is not disclosed in available data). The supplied key is chosen to fall outside the incomplete blocklist. Because the control is a denylist, omission means acceptance. The variable's value carries attacker-controlled data intended to reach a code-generation or command-invocation sink.

3. Payload/execution at the vulnerability-class level. CWE-94 code injection means the accepted value is consumed by a code-generation path — for example, an interpreter or command invocation that Langflow constructs from configuration. The attacker crafts the value so that, once propagated into that sink, it is evaluated/executed as code rather than treated as inert data. At the class level this is the same primitive family as environment-variable-driven code execution (e.g., interpreter-path or loader-path manipulation); the precise mechanism is not disclosed and is not asserted here.

4. Post-exploitation impact. Successful execution runs in the Langflow service context: the Python process, its container, and any mounted secrets. The attacker gains code execution (C:H/I:H/A:H), enabling internal reconnaissance, theft of API keys for upstream LLM providers and databases, lateral movement to services reachable from the host, persistence, and disruption of the AI workflow platform. In containerized deployments without strict isolation, escape to the node is a realistic escalation.

Note: Because the blocklist contents are unknown, defenders cannot enumerate "safe" variables. Treat all user-supplied environment-variable ingestion in affected versions as untrusted.

Impact Assessment

• CVSS 8.8 (High): AV:N — remotely reachable; AC:L — no special conditions; PR:L — any authenticated user; UI:N — no victim action; S:U — impact scoped to the vulnerable Langflow component/process; C:H/I:H/A:H — total loss of confidentiality, integrity, and availability for data and services the process can reach.
• Blast radius: Any internet- or intranet-exposed Langflow instance at 1.0.0–1.11.5 with an obtainable account. Because PR is Low, multi-tenant or self-registration-enabled deployments are especially exposed. A compromised Langflow host typically holds credentials to LLM providers, vector databases, object storage, and internal APIs — expanding impact well beyond the CVE's own System-scope rating.
• Business impact: AI/agent pipelines are increasingly embedded in production workflows; RCE there can corrupt model outputs, exfiltrate proprietary prompts/data, poison agent tooling, and serve as a foothold for lateral movement into data platforms.
• Exploitability: No public exploit or PoC exists, but the vulnerability class (denylist bypass leading to code generation) is well understood by attackers and the barrier is only "obtain any credential." This should be treated as high-risk pending a patch.

Detection Guidance

Sigma Rule

title: Potential Langflow Environment Variable Blocklist Bypass (CVE-2026-79742)
id: 3f7a1c92-8b4e-4d2a-9f31-6a2c55e0d1b7
status: experimental
description: Detects suspicious environment-variable ingestion activity against IBM Langflow
  instances (1.0.0-1.11.5) consistent with an incomplete env-var blocklist bypass leading
  to code injection (CWE-94).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-79742
author: valtersit.com
date: 2026/01/01
logsource:
  category: application
  product: langflow
detection:
  selection_env:
    event.action|contains:
      - 'env'
      - 'variable'
      - 'environment'
    # Candidate malicious variable KEY indicators (case-insensitive matches)
    env.name|contains:
      - 'PYTHONSTARTUP'
      - 'PYTHONPATH'
      - 'LD_PRELOAD'
      - 'LD_LIBRARY_PATH'
      - 'BASH_ENV'
      - 'PERL5OPT'
      - 'NODE_OPTIONS'
      - 'RUBYOPT'
      - 'PYTHONINSPECT'
  selection_value:
    env.value|contains:
      - 'subprocess'
      - 'os.system'
      - 'eval('
      - 'exec('
      - '/bin/sh'
      - 'bash -c'
      - 'curl '
      - 'wget '
  condition: selection_env and selection_value
falsepositives:
  - Legitimate administrative configuration of trusted integrations
  - Development/testing use of custom environment variables
level: high
tags:
  - attack.t1190
  - cve.2026-79742

YARA Rule

rule CVE_2026_79742_Langflow_EnvVar_Blocklist_Bypass
{
    meta:
        author = "valtersit.com"
        description = "Detects suspicious environment-variable definitions in Langflow flow/settings artifacts consistent with incomplete env-var blocklist bypass (CVE-2026-79742, CWE-94)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-79742"
        date = "2026-01-01"
        severity = "high"

    strings:
        $envvar_1 = "PYTHONSTARTUP" ascii nocase
        $envvar_2 = "LD_PRELOAD" ascii nocase
        $envvar_3 = "LD_LIBRARY_PATH" ascii nocase
        $envvar_4 = "BASH_ENV" ascii nocase
        $envvar_5 = "NODE_OPTIONS" ascii nocase
        $envvar_6 = "PERL5OPT" ascii nocase
        $envvar_7 = "RUBYOPT" ascii nocase

        $langflow_1 = "environment_variables" ascii nocase
        $langflow_2 = "env_vars" ascii nocase
        $langflow_3 = "langflow" ascii nocase

        $exec_1 = "os.system" ascii
        $exec_2 = "subprocess" ascii
        $exec_3 = "eval(" ascii
        $exec_4 = "exec(" ascii

    condition:
        uint32(0) != 0x04034b50 and
        filesize < 5MB and
        (
            (any of ($envvar_*) and any of ($exec_*)) or
            ($langflow_3 and any of ($envvar_*) and any of ($exec_*))
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-79742 Possible Langflow Environment Variable Blocklist Bypass Attempt"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"environment"; nocase; http.request_body; pcre:"/(PYTHONSTARTUP|LD_PRELOAD|LD_LIBRARY_PATH|BASH_ENV|NODE_OPTIONS|PERL5OPT|RUBYOPT)/i"; http.request_body; pcre:"/(os\.system|subprocess|eval\(|exec\(|\/bin\/sh)/i"; reference:cve,2026-79742; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-79742; classtype:attempted-admin; sid:202679742; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01, created_by valtersit.com;)

Elastic Detection

// EQL: Detect suspicious environment-variable ingestion in Langflow application logs
// Fires when an env-var configuration event carries a code-execution indicator value.
sequence by host.id, user.name with maxspan=30s
  [ any where event.category == "process" and process.name == "langflow"
      and process.args : "environment" ]
  [ any where event.category == "process"
      and (process.command_line : ("*os.system*", "*subprocess*", "*/bin/sh*", "*bash -c*")
           or process.command_line : ("*PYTHONSTARTUP*", "*LD_PRELOAD*", "*BASH_ENV*", "*NODE_OPTIONS*")) ]

Splunk SPL Query

index=langflow OR index=application sourcetype=langflow:*
| search (event_type="environment" OR message="*environment*variable*")
| search (env_name IN ("PYTHONSTARTUP","LD_PRELOAD","LD_LIBRARY_PATH","BASH_ENV","NODE_OPTIONS","PERL5OPT","RUBYOPT","PYTHONPATH"))
| stats count min(_time) as first_seen max(_time) as last_seen
        values(env_value) as values_supplied
        values(src_ip) as attacker_ip
        values(user) as account
        by host, event_type
| where count > 0
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"),
       last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| sort - count

Wazuh OSSEC Rule

<group name="langflow,web,attack,cve-2026-79742">
  <rule id="100742" level="12">
    <decoded_as>json</decoded_as>
    <field name="app">langflow</field>
    <field name="event_type">environment</field>
    <regex type="pcre2">(?i)(pythonstartup|ld_preload|ld_library_path|bash_env|node_options|perl5opt|rubyopt)</regex>
    <description>CVE-2026-79742: Possible Langflow environment variable blocklist bypass attempt (high-risk env key submitted)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_79742,attack,</group>
  </rule>

  <rule id="100743" level="14">
    <decoded_as>json</decoded_as>
    <field name="app">langflow</field>
    <field name="event_type">environment</field>
    <regex type="pcre2">(?i)(os\.system|subprocess|eval\(|exec\(|/bin/sh|bash -c)</regex>
    <description>CVE-2026-79742: Langflow environment variable value contains code-execution indicator - likely RCE attempt</description>
    <mitre>
      <id>T1059</id>
    </mitre>
    <group>cve_2026_79742,attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence from any tracked source; vendor fix listed as N/A; affected-version OSV packages N/A. No official workaround is published.

1. Immediate mitigations (compensating controls):

   • Restrict network exposure of all Langflow instances (1.0.0–1.11.5) to trusted networks/VPN; do not expose the UI or API to the internet.
   • Enforce strong authentication and disable self-registration; audit and revoke unused accounts, since PR:L means any valid credential is sufficient.
   • If the deployment allows user-supplied environment variables in flows/config, disable or tightly restrict that capability until a fix lands. Because the blocklist is incomplete, do not rely on it as a security control.
   • Run Langflow in a hardened, non-root container with a read-only filesystem where possible, dropped Linux capabilities, seccomp/AppArmor profiles, and no unnecessary secret mounts.
   • Apply egress filtering so a compromised instance cannot reach internal services or external C2/model endpoints beyond what is required.
   • Monitor the detection rules above and alert on any high-risk environment-variable key/value ingestion.

2. Patch/upgrade steps:

   • No fixed version is identified in available data. Do not assume any in-range version (≤1.11.5) is safe.
   • Monitor the IBM Langflow advisory channel and NVD (CVE-2026-79742) for a patched release; when published, upgrade immediately and re-validate. Until then, treat the product as unpatched.

3. Long-term hardening:

   • Replace denylist-based environment-variable filtering with allowlist validation: only explicitly known-safe variable keys should be accepted, and values must be treated as inert data — never evaluated, interpolated into shell/interpreter invocations, or passed to code-generation sinks.
   • Adopt secure-by-default secret handling and avoid exposing any configuration field that maps to process environment or interpreter settings.
   • Integrate dependency and container image scanning, and maintain an SBOM to rapidly identify affected Langflow versions.
   • Log and alert on all configuration changes to flows, components, and environment settings, attributed to authenticated identities.

References

• NVD — CVE-2026-79742: https://nvd.nist.gov/vuln/detail/CVE-2026-79742
• MITRE CWE-94 — Improper Control of Generation of Code ('Code Injection'): https://cwe.mitre.org/data/definitions/94.html
• IBM Security Bulletins (vendor advisory channel — monitor for a Langflow patch): https://www.ibm.com/support/pages/security-bulletins
• FIRST EPSS (score pending at time of writing): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-79742 NOT listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Exploit-in-the-wild / threat actor note: No public PoC, exploit code, Nuclei template, or KEV listing exists at time of writing. No threat actor campaigns are attributed to this CVE in available data. The attack chain documented above is inferred from the vulnerability class (CWE-94 via incomplete environment-variable blocklist) and must be revised once vendor technical details or a patch are published.