CVE-2026-79724 hit Langflow OSS with a CVSS 9.8: unauthenticated remote code execution, no login, no click, full shell. WHAT HAPPENED: IBM Langflow OSS versions 1.0.0 through 1.11.5. CWE-78, improper neutralization of special elements in an OS command. Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, every metric maxed except scope. An attacker sends a crafted request to a Langflow instance, no auth token, no session, and the app executes the supplied OS command and returns the result. That's the entire attack: one HTTP request in, shell output back. IBM shipped 1.11.6 to patch it. Published 2026-09-10. Source: OpenCVE, package at http://pypi.org/project/langflow. Two details worth sitting with: [!] EPSS score: 0.00471, under 1%, rated "Very Low." [!] SSVC enrichment: Automatable = yes. Technical Impact = total. Exploitation = none observed yet. [!] Not listed in CISA's KEV catalog. The scoring systems disagree on the same bug. CVSS says 9.8, near-max severity. EPSS, which models real-world exploitation probability from observed scanning and PoC activity, says under 1% chance of exploitation in the next 30 days. That's not a contradiction, it's EPSS saying "nobody's weaponized this in the wild yet," not "this is safe to leave unpatched." WHY IT WORKS: Langflow is a visual pipeline builder for LLM apps: drag components, wire them into an agent, run it. The core feature is letting users define components that carry arbitrary code paths, by design. When one of those paths builds an OS command string from unsanitized input instead of using an execve-style call with no shell interpretation, you get CWE-78. Scope is Unchanged, so the exploited component doesn't escalate into a separate security domain, but Confidentiality, Integrity, and Availability all sit at High. Whatever the Langflow process user can touch on that host, the attacker can touch. WHAT IT MEANS FOR YOU: If you're running Langflow OSS anywhere between 1.0.0 and 1.11.5 and it's reachable by any untrusted network path, unauthenticated plus Low complexity means no special conditions, no race window, no social engineering needed. Patch to 1.11.6. If you can't patch today, put it behind a firewall or VPN, and don't treat "isolated for now" as a permanent control. It becomes "exposed in the next deploy" faster than anyone updates the runbook. The bigger pattern: AI pipeline builders and agent orchestrators are turning into a new class of high-value, high-exposure infrastructure. Accepting untrusted component definitions is their normal operating mode. Audit what OS-command surfaces exist in yours before someone finds them for you. Which orchestrator are you running, and have you checked its patch notes this month? #LLMSecurity #CVE #AppSec
Post summary
Text discloses CVE-2026-79724 (Langflow OSS, CWE-78, CVSS 9.8, unauthenticated RCE), notes PoC activity reflected in EPSS, confirms no wild exploitation, and directs patching to version 1.11.6.
