CVE-2026-93675

Executive Summary

CVE-2026-93675 is a high-severity (CVSS 8.8) dependency confusion vulnerability in IBM Langflow OSS versions 1.0.0 through 1.12.2 that permits a remote, unauthenticated attacker to achieve arbitrary code execution. The flaw resides in the software's dependency resolution logic (CWE-440: Expected Behavior Violation), where an internal or non-public package dependency can be substituted with a malicious package of the same name from a public repository. Any organization running an affected Langflow OSS instance—particularly in CI/CD or development environments with access to public package registries—is at risk of full host compromise, data exfiltration, and lateral movement.

Technical Analysis

CWE-440 ("Expected Behavior Violation") describes a condition where software fails to behave in the manner expected by its design, specification, or the developer's intent. In the context of this CVE, the NVD description explicitly attributes the vulnerability class to "an expected dependency confusion." Dependency confusion is an attack class that exploits package manager resolution logic: when a package manager (e.g., pip) resolves a dependency name, it may query a public registry before (or instead of) a private/internal registry. If an attacker publishes a package under the same name as an internal-only dependency to the public registry with a higher version number, the resolver may preferentially fetch the attacker-controlled package.

The attack surface for CVE-2026-93675 is the Langflow OSS dependency installation and resolution process. Langflow is a Python-based low-code tool for building AI/LLM workflows, and as such relies on pip-style dependency management. The vulnerability is triggered during dependency installation or environment build: any process that resolves Langflow's dependency tree against a public index without a locked, hash-pinned, and registry-prioritized configuration is potentially affected. The NVD description does not disclose the specific dependency name, the exact resolver configuration flaw, or the precise code path involved. Consequently, the attack mechanism must be understood at the class level—the substitution of a trusted dependency reference with an attacker-controlled package—rather than at the level of a named function, file, or parameter.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicates network exploitable, low attack complexity, no privileges required, and user interaction required (UI:R). The user interaction requirement is consistent with a dependency confusion scenario in which a developer or automated build process must initiate an install or environment build that triggers resolution of the malicious package. The scope is unchanged (S:U), and confidentiality, integrity, and availability impacts are all High (C:H/I:H/A:H), consistent with arbitrary code execution in the context of the installing user—often a developer or CI runner with access to secrets, source code, and internal networks. No exploit code, PoC, or Nuclei template is publicly available per the provided data, and the EPSS score is 0.00678 (50.8th percentile), indicating low but non-zero predicted exploitation activity in the wild.

Exploitation Scenarios

The following chain is inferred from the vulnerability class (dependency confusion, CWE-440) and the NVD description. No public PoC is available; the specific malicious package name, version, and payload are not disclosed.

1. Reconnaissance / target identification. The attacker identifies an organization that uses Langflow OSS in the 1.0.0–1.12.2 range. Because dependency confusion targets internal package names, the attacker enumerates the organization's dependency manifest, lockfile, or public CI logs (if exposed) to discover non-public package names referenced by Langflow's dependency tree. Sources may include public repositories, job postings, or leaked build logs.

2. Trigger of the specific flaw class. The attacker publishes a package to a public registry under the same name as an internal dependency. The published package is assigned a version number higher than any internally used version, exploiting the resolver's expected behavior (CWE-440) of selecting the highest available version across configured indexes. When Langflow's dependency installation or environment build runs, the package manager resolves the name to the attacker-controlled public package rather than the intended internal artifact.

3. Payload / execution method at the vulnerability-class level. The malicious package typically executes code at install time via standard Python packaging mechanisms (e.g., a setup.py install script) or via import-time execution after installation. Because this CVE is specifically a dependency confusion issue, the payload is delivered through the package's build/install lifecycle rather than through a Langflow application input. No specific code pattern, function, or file path from Langflow is named in the NVD description, and none should be assumed.

4. Post-exploitation impact. Successful execution yields arbitrary code execution in the context of the installing process—commonly a developer workstation or CI/CD runner. This enables credential theft (e.g., environment variables, cloud tokens), source code and internal data exfiltration, installation of persistence mechanisms, and lateral movement into internal networks reachable from the build environment. The High confidentiality, integrity, and availability impacts in the CVSS vector reflect the potential for full compromise of the affected host and its connected resources.

Impact Assessment

The business impact of CVE-2026-93675 is severe. Exploitation leads to arbitrary code execution within the environment that installs or builds Langflow—frequently a CI/CD pipeline or developer workstation with privileged access to source control, secrets, and internal services. The blast radius extends beyond the Langflow instance itself: a compromised CI runner can be used to tamper with build artifacts, inject backdoors into downstream software, and pivot into production environments.

The CVSS subscores underscore the severity: Network attack vector (AV:N) means the attacker can operate remotely; Low attack complexity (AC:L) reflects minimal specialized conditions; No privileges required (PR:N) indicates the attacker needs no prior access to the target; and User Interaction (UI:R) reflects that a developer or automated process must initiate the dependency resolution. Scope is Unchanged (S:U), but all three impact metrics are High (C:H/I:H/A:H), meaning total loss of confidentiality, integrity, and availability on the affected component. The EPSS score of 0.00678 places this CVE in the 50.8th percentile of exploited CVEs—low probability of near-term exploitation relative to the broader CVE population, but not negligible. CISA KEV status is NO, and no known threat actor campaigns or in-the-wild exploitation are documented in the provided data.

Affected systems are any deployment, build, or development environment that installs or resolves Langflow OSS versions 1.0.0 through 1.12.2 from untrusted or mixed package indexes. Organizations that pin dependencies with hashes and prioritize internal registries are at reduced risk; those that resolve against public indexes without lockfile integrity controls are at highest risk.

Detection Guidance

Sigma Rule

title: Potential Dependency Confusion Exploitation via Langflow Package Installation
id: 8f3c1a2e-7b4d-4c9e-9a1f-2e5d6c7b8a90
status: experimental
description: Detects suspicious package installation activity consistent with dependency confusion targeting Langflow OSS 1.0.0-1.12.2
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-93675
author: Valters IT Threat Intelligence
date: 2026/01/01
tags:
  - attack.initial_access
  - attack.t1195.001
logsource:
  category: process_creation
  product: linux
detection:
  selection_pip:
    Image|endswith:
      - '/pip'
      - '/pip3'
      - '/python'
      - '/python3'
    CommandLine|contains:
      - 'install'
      - 'langflow'
  selection_suspicious_source:
    CommandLine|contains:
      - '--index-url'
      - '--extra-index-url'
      - '--trusted-host'
  condition: selection_pip and selection_suspicious_source
falsepositives:
  - Legitimate use of additional package indexes in controlled environments
level: medium

YARA Rule

rule CVE_2026_93675_Dependency_Confusion_Langflow
{
    meta:
        description = "Detects suspicious Python package setup artifacts consistent with dependency confusion targeting Langflow OSS"
        author = "Valters IT Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-93675"
        date = "2026-01-01"
        severity = "high"

    strings:
        $s1 = "langflow" nocase
        $s2 = "setup.py" nocase
        $s3 = "install_requires" nocase
        $s4 = "subprocess" nocase
        $s5 = "os.system" nocase
        $s6 = "base64" nocase
        $s7 = "urllib" nocase
        $s8 = "socket" nocase

    condition:
        (uint16(0) == 0x2133 or uint16(0) == 0x2321) and
        filesize < 1MB and
        $s1 and
        $s2 and
        (2 of ($s3, $s4, $s5, $s6, $s7, $s8))
}

Suricata IDS Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-93675 Possible Langflow Dependency Confusion Package Fetch"; flow:established,to_server; content:"GET"; http_method; content:"/simple/"; http_uri; content:"langflow"; http_uri; nocase; classtype:attempted-user; sid:202693675; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01, cve CVE-2026-93675;)

Elastic Detection

process where event.type == "start" and
  process.name in ("pip", "pip3", "python", "python3") and
  process.command_line : "*langflow*" and
  (process.command_line : "*--index-url*" or
   process.command_line : "*--extra-index-url*" or
   process.command_line : "*--trusted-host*")

Splunk SPL Query

index=os sourcetype=process_creation
(process_name="pip" OR process_name="pip3" OR process_name="python" OR process_name="python3")
process_command_line="*langflow*"
(process_command_line="*--index-url*" OR process_command_line="*--extra-index-url*" OR process_command_line="*--trusted-host*")
| stats count values(process_command_line) as cmds values(user) as users by host
| where count > 0

Wazuh OSSEC Rule

<group name="langflow,dependency_confusion,">
  <rule id="100875" level="10">
    <if_sid>100874</if_sid>
    <field name="command">pip|pip3|python|python3</field>
    <match>langflow</match>
    <regex>--index-url|--extra-index-url|--trusted-host</regex>
    <description>CVE-2026-93675: Possible Langflow dependency confusion package installation attempt detected</description>
    <mitre>
      <id>T1195.001</id>
    </mitre>
    <group>supply_chain,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix is available as of reporting.

1. Immediate mitigations.

   • Pin all Langflow dependencies to exact versions with cryptographic hashes (e.g., pip --require-hashes with a fully populated requirements file), preventing resolution of substitute packages.
   • Configure package managers to prioritize internal/private registries and disable fallback to public indexes for internal package names. Where feasible, use a proxy registry that blocks public resolution of namespaces owned internally.
   • Reserve internal package names proactively on public registries to prevent name-squatting (defensive namespace registration).
   • Restrict outbound network access from CI/CD runners and developer environments to only approved package indexes.
   • Monitor build logs and process telemetry for unexpected package source URLs or version jumps.

2. Patch/upgrade steps.

   • No patch is available. Monitor the Langflow project and IBM advisories for a fixed release addressing CVE-2026-93675. When released, upgrade to the patched version and re-validate dependency integrity.
   • Until a patch exists, treat affected versions as vulnerable and apply the mitigations above.

3. Long-term hardening.

   • Adopt lockfile-based dependency management with integrity verification across all Python projects.
   • Implement software composition analysis (SCA) and dependency confusion detection in the CI pipeline.
   • Enforce least privilege for CI/CD runners, with short-lived credentials and no persistent access to production secrets.
   • Conduct regular dependency review and maintain an inventory of internal-only package names to protect against namespace takeover.

References

• NVD — CVE-2026-93675: https://nvd.nist.gov/vuln/detail/CVE-2026-93675
• CWE-440: Expected Behavior Violation — https://cwe.mitre.org/data/definitions/440.html
• MITRE ATT&CK T1195.001: Supply Chain Compromise — https://attack.mitre.org/techniques/T1195/001/
• EPSS — CVE-2026-93675 scoring data: https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (status: not listed) — https://www.cisa.gov/known-exploited-vulnerabilities-catalog