Executive Summary
A critical remote code execution vulnerability (CVE-2026-19286) has been disclosed in IBM Langflow OSS, the widely used open-source framework for building AI and LLM agent workflows. The flaw carries a CVSS score of 9.8 and stems from improper enforcement of security restrictions on Langflow's Agent-to-Agent (A2A) public endpoint, allowing an unauthenticated remote attacker to execute arbitrary code on the underlying server.
CVSS Score: 9.8 (Critical)
Langflow versions 1.0.0 through 1.11.1 are affected. The A2A endpoint is designed to let autonomous agents exchange tasks and data with a Langflow instance, but insufficient access control on that surface means an attacker with only network reach to the endpoint can trigger code execution — no credentials or user interaction required.
This is the latest in a string of critical RCE disclosures affecting Langflow over the past several months, following the CISA KEV-listed CVE-2025-3248 and the more recent CVE-2026-33017 and CVE-2026-5027, underscoring that AI orchestration platforms remain a high-value, frequently-exploited attack surface.
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-19286 |
| CVSS Score | 9.8 (Critical) |
| CWE | CWE-94 — Improper Control of Generation of Code ('Code Injection') |
| Type | Unauthenticated Remote Code Execution |
| Attack Vector | Network (no authentication required) |
| Privileges Required | None |
| User Interaction | None |
| Vulnerable Component | A2A (Agent-to-Agent) public endpoint |
Affected Versions
| Product | Affected Versions | Recommendation |
|---|---|---|
| IBM Langflow OSS | 1.0.0 through 1.11.1 | Upgrade to the latest patched release immediately |
Technical Details
Langflow's A2A endpoint is intended to allow one Langflow-hosted agent to hand off tasks to another over the network. The improper enforcement of security restrictions on this endpoint means the server does not adequately validate or sandbox what it accepts from a calling agent, creating a pathway for arbitrary code execution consistent with the same class of vulnerability (CWE-94) seen in earlier Langflow flaws where untrusted flow data reaches Python's exec() without proper isolation.
Because the A2A endpoint is exposed on default deployments that enable agent-to-agent communication, and because the CVSS vector reflects no privileges and no user interaction (AV:N/AC:L/PR:N/UI:N), any Langflow instance with the A2A feature reachable from an attacker's network is exploitable without any prior foothold.
Attack Vector
1. Attacker identifies a Langflow OSS instance (1.0.0-1.11.1) with the A2A endpoint reachable
2. Attacker sends a crafted request to the public A2A endpoint
3. Langflow processes the request without enforcing intended security restrictions
4. Malicious payload executes as arbitrary code within the Langflow server process
5. Attacker gains full control of the host running Langflow — credentials, connected data
sources, and any downstream systems the flows are wired intoImpact of Successful Exploitation
| Impact | Description |
|---|---|
| Remote Code Execution | Arbitrary code runs in the context of the Langflow server process |
| Credential Theft | Exposure of API keys and model provider credentials configured in flows |
| Data Exfiltration | Access to any datasets, vector stores, or documents wired into flows |
| Lateral Movement | Pivot into internal networks or connected AI/agent infrastructure |
| AI Supply Chain Risk | Compromise of an orchestration layer that many downstream agents rely on |
Immediate Remediation
Step 1: Patch Langflow
Update to the fixed release as soon as IBM/the Langflow project publishes it for the 1.11.x line, and confirm the version reported no longer falls in the 1.0.0-1.11.1 range.
pip install --upgrade langflow
langflow --versionStep 2: Restrict Network Exposure
- Do not expose Langflow instances directly to the public internet
- Place instances behind a VPN, reverse proxy with authentication, or private network segment
- If the A2A feature is not in active use, disable it until a patch is confirmed applied
Step 3: Review for Signs of Compromise
# Review Langflow server logs for unexpected requests to A2A endpoints
grep -i "a2a" /path/to/langflow/logs/*.log
# Look for anomalous outbound connections from the Langflow host
netstat -tupn | grep ESTABLISHEDIf Immediate Patching Is Not Possible
- Block or firewall access to the A2A endpoint at the network edge
- Take internet-facing instances offline until patched
- Rotate all credentials stored in or accessible to affected Langflow instances
- Monitor for unusual process activity on hosts running Langflow
Detection Indicators
| Indicator | Description |
|---|---|
| Unexpected requests to the A2A endpoint | Possible exploitation attempts |
| Unrecognized child processes spawned by the Langflow service | Sign of successful code execution |
| Outbound connections to unfamiliar hosts from the Langflow server | Post-exploitation data exfiltration or C2 |
| New or modified flows not created by known users | Attacker-planted flow logic |
Post-Remediation Steps
- Confirm the Langflow version is patched and out of the 1.0.0-1.11.1 range
- Audit A2A endpoint exposure and restrict to trusted networks only
- Rotate all API keys and model provider credentials referenced by flows
- Review flow definitions for unauthorized changes
- Enable logging and monitoring on the Langflow host if not already in place
- Track IBM's security bulletins for Langflow OSS for the confirmed fixed version
References
- NVD — CVE-2026-19286
- Endor Labs — CVE-2026-33017, Unauthenticated RCE in Langflow via Public Flow Build Endpoint
- The Hacker News — Langflow Flaw CVE-2026-5027 Exploited for Unauthenticated RCE