# CVE-2026-7873: Langflow OSS - RCE

> Live exploitation tracking for CVE-2026-7873 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2026-7873

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.9
- **Public exploit available:** Yes
- **Affected products:** IBM Langflow OSS
- **Weaknesses:** CWE-94 (Improper Control of Generation of Code ('Code Injection'))
- **Tags:** web_application

## Description

IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated attackers to execute arbitrary OS commands and read sensitive files including credentials, enabling complete system compromise and lateral movement.

## CrowdSec analysis

[CVE-2026-7873](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-7873) is a critical vulnerability in IBM Langflow OSS versions 1.0.0 through 1.10.0 that allows authenticated attackers to execute arbitrary operating system commands and read sensitive files, including credentials. Successful exploitation could lead to complete system compromise and enable attackers to move laterally through connected environments.

CrowdSec has been tracking this vulnerability and its exploits since 3rd of November 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2026-7873 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Authenticated exploitation attempts target `POST /api/v1/validate/code` with a Bearer token and Python code in the JSON `code` field, often using an outbound HTTP or DNS callback to verify command execution. Requests to `/api/v1/auto_login` or `/api/v1/login` may precede the exploit to obtain an access token.

## Timeline

- 2026-06-30: CVE Published. CVE-2026-7873 is published to NVD.
- 2026-11-03: Rule Released. CrowdSec releases a rule to detect CVE-2026-7873 exploitation attempts against the CrowdSec Network.
- 2026-11-04: First exploitation attempt seen by CrowdSec

## References

- https://www.ibm.com/support/pages/node/7278441
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-7873.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2026-7873) follows observed exploitation activity for CVE-2026-7873. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.