← News
/DISPATCH · 2026-08-31

IBM Langflow OSS Three Critical RCEs CVE-2026-19286/19295/18729: AI Workflow Orchestration Platform Executes Arbitrary Code Without Authentication

Langflow 1.0.0–1.11.1 A2A public endpoint code-execution guard fails. CVSS 9.8. Unauthenticated attackers send a request to an exposed agent flow and run arbitrary system commands on the server. AI/ML pipelines face remote takeover.

IBM published a security advisory on 24 August 2026 disclosing three critical RCEs in the Langflow open-source project. All CVSS scores land in the 9.x Critical band. CVEs: CVE-2026-19286, CVE-2026-19295, CVE-2026-18729. Affects Langflow 1.0.0 through 1.11.1. Langflow is a LangChain-based visual AI workflow orchestration platform. GitHub repo has 149k stars. Widely used for rapid RAG, Agent, Prompt Chain builds.

Vulnerability Technical Details

CVE-2026-19286 is a code injection flaw in the A2A (Agent-to-Agent) public endpoint. When the A2A endpoint is enabled and an agent flow is exposed, the mechanism meant to block code execution is incorrectly implemented. Unauthenticated attackers execute arbitrary code on the Langflow server via crafted requests. CVSS 9.8, low complexity, network vector, no privileges, no user interaction.

CVE-2026-19295 sits in the flow-template eval path. Authenticated users bypass the disable-custom-components setting, then escalate to arbitrary OS commands.

CVE-2026-18729 is insufficient input-path protection in the code-generation stage. Low-privilege authenticated users bypass guards and execute arbitrary code on the Langflow server.

Types: CWE-94 Code Injection, CWE-95 Eval Injection, CWE-77 Command Injection.

Typical AI Workflow Topology

In enterprise RAG, Langflow typically wires to vector DBs (Pinecone, Milvus, Weaviate, Qdrant), LLM inference (OpenAI, Anthropic, vLLM, Ollama), business API gateways, knowledge bases (Confluence, SharePoint, Notion, Slack), and auth (Keycloak, Auth0, Okta). Langflow nodes often hold vector-store R/W keys, model inference tokens, enterprise SSO credentials, and external business-system access tokens. Stacked, the three bugs let attackers pivot into those integrations and plant hidden instructions in RAG retrieval results to poison model output—data poisoning plus prompt injection. Treat Langflow as critical AI infrastructure: regular vuln management, SAST/SCA, container image scanning.

Impact Assessment

The three bugs chain anonymous → low-privilege → code execution. Attack surface spans A2A endpoints, flow templates, custom-component load paths. In enterprise deployments Langflow stitches RAG retrieval, vector DBs, model inference, and external API calls. Servers hold sensitive model data, API keys, and business documents. Arbitrary code execution means the model layer, vector store, API credentials, and downstream systems all fall. CVSS 9.8 network reachability plus unauthenticated exploitability makes this trivial for automated scanners to weaponize at scale.

Remediation

Langflow shipped fixes. Upgrade all affected deployments to 1.11.2 or later immediately. Prefer internal network or identity-proxy exposure. Disable or restrict external reachability of A2A public endpoints. Add a second confirmation step on eval and custom-component load. Least-privilege the Langflow process account; filesystem read-only constraints.

Detection: Langflow process spawning unexpected shells; outbound curl/wget; unexpected Python child processes; unexpectedly created user/service accounts.

References