CVE-2026-97674

Executive Summary

CVE-2026-97674 is a code injection vulnerability (CWE-94) in IBM Langflow OSS versions 1.0.0 through 1.12.2 that allows a remote authenticated attacker to execute arbitrary operating system commands. The flaw stems from improper neutralization of special elements used in OS commands combined with improper control of code generation. With a CVSS base score of 8.1, the vulnerability poses a high confidentiality and integrity impact to affected deployments, though availability is unaffected.

Technical Analysis

Langflow is an open-source low-code tool for building and deploying AI-powered agents and workflows. The NVD description identifies the core weakness as CWE-94: Improper Control of Generation of Code ("Code Injection"), specifically manifesting as improper neutralization of special elements used in an OS command. This means that user-supplied input is incorporated into an OS command without adequate sanitization, allowing an authenticated remote attacker to inject and execute arbitrary commands on the underlying host.

The vulnerability requires authentication (PR:L), indicating that the attacker must possess valid credentials to access the Langflow instance. The attack vector is network-based (AV:N) with low attack complexity (AC:L), meaning no special conditions or race conditions are required to exploit it. The scope is unchanged (S:U), suggesting the impact is confined to the security authority of the vulnerable component itself. The successful exploitation leads to high confidentiality and integrity impact (C:H/I:H) but no availability impact (A:N), implying the attacker can read sensitive data and modify system state without necessarily causing a denial of service.

The affected versions are IBM Langflow OSS 1.0.0 through 1.12.2. The exact vulnerable component or endpoint is not specified in the NVD description, but the class of vulnerability indicates that any feature accepting user input that is later passed to a system shell or command execution function is a potential attack surface. This could include tool integrations, code execution nodes, or any customization point where Langflow allows users to define or execute scripts.

Because the description explicitly mentions "improper control of code generation," it is likely that the vulnerability involves a code generation or template rendering feature within Langflow that constructs OS commands dynamically. Without further vendor detail, the precise function or API endpoint cannot be confirmed, but the mechanism is clear: attacker-controlled input reaches an OS command without proper sanitization.

Exploitation Scenarios

No public PoC or exploit code is available for CVE-2026-97674. The following attack chain is inferred from the vulnerability class and the NVD description.

1. Reconnaissance and Target Identification: An attacker identifies an exposed Langflow instance via Shodan or network scanning. The attacker must possess valid credentials, either through prior compromise, default credentials, or social engineering, to authenticate to the Langflow application.

2. Triggering the Flaw: Once authenticated, the attacker navigates to a feature within Langflow that accepts user input which is subsequently used to construct an OS command. This could be a component that executes system commands, a custom tool definition, or any functionality that allows code or command generation. The attacker injects shell metacharacters (e.g., ;, |, &&, $()) into the input field. Due to improper neutralization, these special elements are not escaped, allowing the attacker to append or inject arbitrary OS commands.

3. Payload Execution: The injected commands are executed with the privileges of the Langflow process. The attacker can run commands to read files, exfiltrate data, establish persistence, or pivot to other systems. Because the CVSS vector shows no availability impact, the attacker may focus on stealthy data exfiltration or integrity modifications rather than destructive actions.

4. Post-Exploitation Impact: With command execution, the attacker can access sensitive configuration files, API keys, database credentials, and other secrets stored on the host. They can also modify Langflow configurations or inject malicious code into workflows, potentially affecting downstream users and integrations. The high confidentiality and integrity impact reflects the potential for significant data breach and system tampering.

Impact Assessment

The CVSS 3.1 base score of 8.1 (High) reflects a serious vulnerability. The vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N indicates:

• Attack Vector (Network): Exploitable remotely over the network.
• Attack Complexity (Low): No special conditions required.
• Privileges Required (Low): Attacker needs basic authenticated access.
• User Interaction (None): No victim action needed.
• Scope (Unchanged): Impact limited to the vulnerable component.
• Confidentiality (High): Significant data exposure possible.
• Integrity (High): Ability to modify data or system state.
• Availability (None): No impact on system availability.

Business impact includes unauthorized access to sensitive data processed by Langflow, potential compromise of connected AI models and data sources, and the ability to modify workflows, which could lead to data poisoning or further attacks. The blast radius includes the Langflow host and any systems or data accessible from it. Given Langflow's role in AI orchestration, a compromise could affect multiple AI applications and their data pipelines.

Detection Guidance

Sigma Rule

title: IBM Langflow OS Command Injection Attempt
id: 8f3c2a1b-4d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects potential OS command injection attempts against IBM Langflow OSS (CVE-2026-97674)
author: Threat Intelligence
date: 2026-01-01
logsource:
    category: webserver
    product: langflow
detection:
    selection:
        http.method: 'POST'
        http.url|contains:
            - '/api/v1/'
            - '/run'
            - '/execute'
        http.request.body|contains:
            - ';'
            - '|'
            - '&&'
            - '$('
            - '`'
            - '>'
            - '<'
    condition: selection
falsepositives:
    - Legitimate use of special characters in workflow definitions
level: high

YARA Rule

rule CVE_2026_97674_Langflow_Command_Injection
{
    meta:
        description = "Detects OS command injection patterns targeting IBM Langflow OSS"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "CVE-2026-97674"
        severity = "high"
    strings:
        $s1 = "langflow" nocase
        $s2 = ";id" nocase
        $s3 = ";whoami" nocase
        $s4 = "|cat /etc/passwd" nocase
        $s5 = "$(curl" nocase
        $s6 = "`wget" nocase
        $s7 = "&&" nocase
    condition:
        $s1 and any of ($s2, $s3, $s4, $s5, $s6) or ($s1 and #s7 > 2)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-97674 IBM Langflow OS Command Injection Attempt"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"/api/"; http.request_body; content:";"; content:"|7c|"; content:"&&"; content:"$("; threshold: type limit, track by_src, count 1, seconds 60; classtype:attempted-admin; sid:10000001; rev:1;)

Elastic Detection

sequence by process.entity_id
  [process where event.type == "start" and process.parent.name : ("langflow", "python") and process.name : ("sh", "bash", "cmd.exe", "powershell.exe")]
  [network where event.type == "connection" and destination.port in (80, 443, 8080, 3000)]

Splunk SPL Query

index=web sourcetype=langflow_access
| search http_method=POST
| rex field=http_uri "(?<endpoint>/api/[^?]+)"
| search endpoint IN ("/api/v1/run", "/api/v1/execute", "/api/v1/process")
| eval injection_indicators = if(match(request_body, "(\;|\||\&\&|\$\(|\`|>|<)"), "SUSPECT", "CLEAN")
| where injection_indicators="SUSPECT"
| stats count by src_ip, endpoint, request_body
| sort -count

Wazuh OSSEC Rule

<group name="langflow,web,attack,">
  <rule id="100200" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <field name="url">/api/</field>
    <field name="request_body">\.*[\;\|\&\&\(\)\`\>\<]\.*</field>
    <description>CVE-2026-97674: IBM Langflow OS Command Injection attempt detected</description>
    <mitre>
      <id>T1059</id>
    </mitre>
    <group>command_injection,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate Mitigations:

   • Restrict network access to Langflow instances to trusted IP ranges and require strong authentication.
   • Implement strict input validation and sanitization on all user-supplied data, particularly for fields that may be passed to OS commands.
   • Disable or restrict features that allow arbitrary code or command execution until a patch is available.
   • Monitor logs for suspicious command injection patterns and anomalous process execution.
   • Apply the principle of least privilege to the Langflow service account to limit the impact of successful exploitation.

2. Patch/Upgrade Steps:

   • No patch is currently available. Monitor IBM and Langflow OSS repositories for updates.
   • Once a patched version is released, upgrade immediately. Verify the version is beyond 1.12.2 and includes a fix for CVE-2026-97674.
   • If upgrading is not possible, consider isolating the Langflow instance in a segmented network with restricted outbound access.

3. Long-Term Hardening:

   • Adopt secure coding practices, including the use of parameterized interfaces for OS commands and avoidance of shell invocation where possible.
   • Implement web application firewalls (WAFs) with rules to detect and block command injection attempts.
   • Conduct regular security assessments and penetration testing of Langflow deployments.
   • Enforce multi-factor authentication and robust credential management for Langflow access.

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-97674
• IBM Security Bulletin: [Pending] — monitor https://www.ibm.com/blogs/psirt/ for updates.
• Langflow OSS Repository: https://github.com/langflow-ai/langflow
• CWE-94: Improper Control of Generation of Code: https://cwe.mitre.org/data/definitions/94.html
• CISA KEV Catalog: Not listed as of current date. No known exploit-in-the-wild evidence or threat actor campaigns identified at this time.