CVE-2026-79724

IBM Langflow OSS versions 1.0.0 through 1.11.5 contain an OS command injection flaw (CWE-78) in which special elements are not properly neutralized before being used in an OS command. Because the CVSS 3.1 vector is network-exploitable with no privileges, no authentication, and no user interaction required, a remote attacker who can reach an exposed instance can send crafted input and execute arbitrary operating-system commands as the Langflow service user. Successful exploitation gives full compromise of the host or container, including any LLM API keys, credentials, and data stored in flows. Langflow is a self-hosted, open-source visual builder for AI agents and RAG workflows, so anyone running the affected versions — especially instances exposed to the internet — is at risk. The flaw is rated critical (CVSS 9.8), but it is not in CISA's KEV catalog, no public PoC is known, and no exploitation has been reported; note, however, that a prior similar unauthenticated RCE in Langflow (CVE-2025-3248) was exploited in the wild, so defenders should not assume this will stay quiet.

What to do: Upgrade IBM Langflow OSS beyond 1.11.5 to the patched release specified in IBM's security bulletin as soon as it is available. Until patched, do not expose Langflow to the internet — bind it to localhost or an internal network, place it behind an authenticated reverse proxy or VPN, and run it in an isolated container with minimal privileges. Audit host and container logs for unexpected command or subprocess execution and rotate any API keys or credentials stored in flows.