Three critical flaws let attackers run code on Langflow servers

Langflow, an open-source tool for building large language model workflows, disclosed three critical security advisories on 5 October 2026. Together they affect versions up to 1.10.2 and allow attackers to run arbitrary code on the machine hosting Langflow. Each advisory has a fix in a later release.

The first, tracked as CVE-2026-7700, concerns the Smart Transform component in versions 1.3.0 through 1.10.2. According to the advisory, Smart Transform puts the flow author's instructions and a preview of the input data into a prompt, asks a language model to write a one-line Python lambda, then runs that lambda with Python's full set of built-in functions. The only checks applied are that the text starts with "lambda" and contains a colon. The advisory gives the example lambda x: __import__("os").system("id"), which passes those checks and executes a shell command. A malicious flow author can trigger this directly through the Instructions field. Where a flow passes attacker-controlled content into Smart Transform, an attacker can also trigger it indirectly through prompt injection, which is hidden instructions in data that the model then obeys. Success depends on the configured model following the injected instruction. The fix validates the generated code's structure and runs it with a restricted set of built-ins. It shipped in Langflow 1.11.0 and was backported to 1.10.3. Langflow credits Peyton Kennedy of Endor Labs as the original finder, with four duplicate reports.

The second advisory, CVE-2026-51886, covers the /api/v1/validate/code endpoint. The endpoint was meant to check user-supplied code for errors, but it used Python's exec() on function definitions. Defining a function does not run its body, but Python does evaluate any decorators attached to it immediately. The advisory shows a payload that uses a decorator to create a file on the server. Langflow said the endpoint had no authentication at all until version 1.7.2, so the same sink was reachable without logging in before that. From 1.7.2 to 1.10.0 any authenticated user could trigger it, including any user at all when automatic login is enabled. Version 1.10.1 stops executing submitted definitions and only compiles them.

The third, CVE-2026-8505, is a webhook authentication bypass in versions 1.7.0 to 1.9.0. The WEBHOOK_AUTH_ENABLE setting shipped with a default of False, and the advisory says that in that state Langflow returned the flow owner's identity without checking the API key in the request. Anyone who knew a flow's UUID could run that flow with a simple POST request. Langflow said this could lead to remote code execution, because flows often contain components that execute Python, and to denial of service by triggering heavy flows repeatedly. A related report demonstrated a working code execution chain through the same bypass. Version 1.9.1 changed the default to True.

Langflow's interim advice for the Smart Transform issue is to remove the component from runnable flows, restrict flow editing and execution to trusted users, keep untrusted data out of it, and limit the Langflow process's access to files, networks and credentials.