CVE-2026-81204

Executive Summary

CVE-2026-81204 is a critical code injection vulnerability (CWE-94) in IBM Langflow OSS versions 1.0.0 through 1.11.5, allowing unauthenticated remote attackers to execute arbitrary code during graph construction. With a CVSS score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), successful exploitation grants full confidentiality, integrity, and availability impact to the affected Langflow instance and potentially the underlying host. Organizations running Langflow OSS within this version range are at immediate risk, as no patch, workaround, or public PoC is currently available.

Technical Analysis

CWE-94 (Improper Control of Generation of Code — "Code Injection") describes a class of vulnerabilities where an application dynamically constructs executable code from externally influenced input without adequate sanitization, allowing an attacker to inject and execute arbitrary statements.

In the specific case of CVE-2026-81204, the NVD description states that the flaw is triggered "during graph construction." Langflow is a low-code / visual framework for building LLM-based agent workflows, where users assemble "flows" represented as directed graphs of components (nodes) connected by edges. Graph construction refers to the process by which a submitted flow definition — typically a JSON document describing components, their parameters, and their connections — is parsed, instantiated, and wired together into an executable pipeline.

Because the flow graph schema supports arbitrary component parameters and the framework compiles and executes component logic at build time, unsanitized user-controlled input present in a submitted graph is evaluated as code rather than treated as inert data. A remote attacker can therefore submit a crafted graph that results in arbitrary code execution on the Langflow server.

Key technical characteristics derivable from the provided data:

• Attack vector is Network (AV:N).
• Attack complexity is Low (AC:L) — no race conditions or special preconditions are described.
• No privileges are required (PR:N) — Langflow deployments are frequently exposed without authentication, and the description explicitly states "a remote attacker" without qualification.
• No user interaction is required (UI:N).
• Scope is Unchanged (S:U), meaning the vulnerability's exploitation is scoped to the security authority of the vulnerable Langflow component itself, though the host process runs with the privileges of the Langflow service account.
• Confidentiality, Integrity, and Availability impacts are all High (C:H/I:H/A:H), consistent with full arbitrary code execution in the server process.

No function names, endpoints, parameter names, or class names are recoverable from the provided NVD description or CNA title. The description is sparse beyond the vulnerability class, the affected product range, and the trigger context (graph construction). Analysts should not assume specific node types or API paths without independent validation.

The affected version window is broad (1.0.0 through 1.11.5), which suggests the vulnerable code path has been present for a long release history and may be deeply embedded in the graph compilation pipeline rather than isolated to a single feature.

Exploitation Scenarios

The following attack chain is inferred strictly from the vulnerability class (CWE-94 code injection) and the stated trigger context ("during graph construction"). No public PoC exists; specific code patterns, node names, and parameters are intentionally not fabricated.

1. Reconnaissance / target identification: An attacker identifies internet- or intranet-exposed Langflow instances. Langflow deployments commonly expose a web UI and REST API on a well-known port; asset discovery can leverage Shodan dorks such as http.title:"Langflow" or http.html:"Langflow". The attacker confirms the running version falls within 1.0.0–1.11.5.

2. Triggering the flaw: The attacker submits a crafted flow graph — a structured document defining components and their connections — to the Langflow API or UI endpoint responsible for graph construction. Because the flaw resides in the graph construction phase, no authentication or elevated privilege is required. The malicious payload is embedded within graph field values that the framework subsequently compiles as code.

3. Payload / execution method: At the vulnerability-class level, the injection causes attacker-supplied content to be interpreted and executed as code by the Langflow server process. The specific injection primitive (e.g., which graph field is unsafe) is not disclosed in the available intelligence and should be confirmed via vendor guidance or independent research. Execution occurs with the privileges and environment of the Langflow service account.

4. Post-exploitation impact: Successful execution enables the attacker to run arbitrary commands, exfiltrate environment variables and secrets (commonly including LLM API keys, database credentials, and cloud tokens held by Langflow), pivot into connected systems, establish persistence, or disrupt service (availability impact). Because Langflow frequently integrates with external LLM providers and data stores, credential theft represents a high-value secondary objective.

Impact Assessment

CVSS 9.8 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects:

• AV:N / AC:L: Exploitable over the network with minimal effort and no special conditions.
• PR:N / UI:N: No authentication and no victim interaction — any reachable instance is a candidate target.
• C:H / I:H / A:H: Full compromise of data confidentiality, integrity, and availability within the vulnerable component's security scope.

Business impact includes full server compromise of the Langflow host process, theft of integrated credentials and LLM API keys, unauthorized access to connected data sources, potential supply-chain effects if Langflow serves downstream applications, and service disruption. The blast radius extends beyond the Langflow application to any systems, secrets, or networks reachable from the Langflow service account.

Detection Guidance

Sigma Rule

title: Suspicious Langflow Graph Construction Code Injection Attempt
id: 9f1c2b3a-7d4e-4a11-9b8c-1e2f3a4b5c6d
status: experimental
description: Detects requests to Langflow endpoints carrying graph payloads with code-injection indicators (CVE-2026-81204)
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-81204
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-stem|contains:
      - '/api/v1/'
      - '/flow'
      - '/build'
  selection_payload:
    - cs-uri-query|contains:
        - 'eval('
        - '__import__'
        - 'os.system'
        - 'subprocess'
        - 'exec('
  condition: selection_endpoint and selection_payload
falsepositives:
  - Legitimate developer testing with eval-like strings
level: high

YARA Rule

rule CVE_2026_81204_Langflow_CodeInjection
{
    meta:
        author = "valtersit.com"
        description = "Detects code-injection indicators in Langflow graph construction payloads (CVE-2026-81204)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-81204"
        date = "2026-01-01"
    strings:
        $a = "__import__" ascii nocase
        $b = "os.system" ascii nocase
        $c = "subprocess" ascii nocase
        $d = "eval(" ascii nocase
        $e = "exec(" ascii nocase
        $f = "langflow" ascii nocase
    condition:
        uint16(0) == 0x7B7B or true
        and 2 of ($a,$b,$c,$d,$e,$f)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-81204 Langflow Graph Construction Code Injection Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"langflow"; nocase; http.request_body; content:"__import__"; nocase; http.request_body; content:"subprocess"; nocase; reference:cve,2026-81204; classtype:attempted-admin; sid:202681204; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [network where network.protocol == "http" and http.request.method == "POST" and
   url.path : ("*langflow*" or "*flow*" or "*build*")]
  [network where http.request.body : ("*__import__*" or "*os.system*" or "*subprocess*" or "*eval(*")]

Splunk SPL Query

index=web OR index=proxy
| search (uri_path="*langflow*" OR uri_path="*flow*" OR uri_path="*build*")
| eval payload=coalesce(request_body, cs_uri_query, "")
| where match(payload, "(?i)(__import__|os\.system|subprocess|eval\(|exec\()")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri_path, payload
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,langflow,">
  <rule id="2026812" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <field name="url">langflow|flow|build</field>
    <regex type="pcre2">(?i)(__import__|os\.system|subprocess|eval\(|exec\()</regex>
    <description>CVE-2026-81204: Langflow graph construction code injection attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Do not expose Langflow OSS to untrusted networks. Restrict access via firewall/security groups to trusted IP ranges only.
   • Enforce authentication and authorization at a reverse proxy in front of Langflow if the deployment lacks built-in auth.
   • Run the Langflow service under a least-privilege, low-privileged OS account with no shell, and use containerization with read-only filesystems and restricted egress.
   • Monitor for and block graph-construction payloads containing code-execution indicators (see detection rules above).
   • Rotate any credentials, LLM API keys, or tokens accessible to the Langflow service account out of an abundance of caution.

2. Patch / upgrade steps:

   • No vendor fix is currently available for versions 1.0.0 through 1.11.5. Monitor IBM and the Langflow project for an updated advisory; Langflow versions above 1.11.5 may contain a fix, but this has not been confirmed by any tracked source and must not be assumed.
   • When a patch is released, upgrade immediately and verify the running version.

3. Long-term hardening:

   • Adopt a vulnerability management workflow that tracks Langflow and other LLM-orchestration frameworks as internet-facing attack surface.
   • Apply network segmentation around AI orchestration infrastructure.
   • Enforce secrets management (e.g., vaulting API keys) rather than environment-embedded credentials.
   • Deploy runtime application self-protection or egress filtering to limit post-exploitation impact of code injection flaws.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-81204
• MITRE CWE-94: https://cwe.mitre.org/data/definitions/94.html
• IBM Security Advisories: https://www.ibm.com/support/pages/security-bulletins
• Langflow project repository / release notes: https://github.com/langflow-ai/langflow
• CISA Known Exploited Vulnerabilities catalog (checked — CVE-2026-81204 not listed as of reporting): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public PoC, exploit code, Nuclei template, threat-actor campaign, or exploit-in-the-wild evidence is known at the time of writing. EPSS has not yet assigned a score.