# CVE-2026-93674: Langflow OSS - RCE

> Live exploitation tracking for CVE-2026-93674 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2026-93674

## Key facts

- **Exploitation phase:** Insufficient Data. Not enough CrowdSec telemetry data is available to confidently assess how this vulnerability is exploited in the wild.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** IBM Langflow OSS
- **Weaknesses:** CWE-94 (Improper Control of Generation of Code ('Code Injection'))
- **Tags:** ai_mcp, web_application

## Description

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.

## CrowdSec analysis

[CVE-2026-93674](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-93674) is a critical OS command injection vulnerability affecting IBM Langflow OSS versions 1.0.0 through 1.12.2. Remote unauthenticated attackers could exploit improper handling of special command elements to execute arbitrary code, potentially compromising system confidentiality, integrity, and availability.

CrowdSec has been tracking this vulnerability and its exploits since 20th of October 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2026-93674 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers target Langflow’s `/api/v1/auto_login`, `/api/v1/custom_component`, and `/api/v1/validate/code` endpoints to obtain a JWT, plant a Python module, and trigger its import. The crafted import can execute code on the server, leading to remote command execution.

## Timeline

- 2026-10-07: CVE Published. CVE-2026-93674 is published to NVD.
- 2026-10-20: Rule Released. CrowdSec releases a rule to detect CVE-2026-93674 exploitation attempts against the CrowdSec Network.
- 2026-10-21: First exploitation attempt seen by CrowdSec

## References

- https://www.ibm.com/support/pages/node/7290694
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-93674.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2026-93674) follows observed exploitation activity for CVE-2026-93674. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.