CVE-2026-93675
Langflow 1.0.0 – 1.12.3
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-93675 is a high-severity Expected Behavior Violation (CWE-440) vulnerability in Langflow Langflow. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 46% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-17 (Developer Security and Privacy Architecture and Design) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-94115
Vulnerability Data
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to an expected dependency confusion.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation directly checks whether implemented functions match their specifications.
Requiring a documented security architecture and design reduces the chance that implementation deviates from intended behavior.
Security function verification confirms that functions operate according to their defined expected behavior.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Security testing and exercises help discover behavior deviations before deployment.
Vulnerability identification can surface spec-violating flaws, while eliminating the weakness reduces some vulnerability backlog.
Routine software maintenance and patching can remediate discovered specification violations.
Secure SDLC practices directly enforce specification compliance and catch expected-behavior violations during development.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure development life cycle mandates verification against specifications, directly reducing expected-behavior violations.
A.8.26 only requires that security requirements (including resilience against attacks like injections) be identified and specified during development or acquisition; it does not itself enforce, implement or assure those requirements, so the expected-behavior violation can still arise and be exploited.
Secure coding practices enforce adherence to functional specifications during implementation.
Security testing in development and acceptance validates that functions behave as specified.