Is CVE-2026-51886 actively exploited?

Yes. Previdian has observed exploitation attempts targeting this CVE. Confidence is confirmed.

What exploitation activity has Previdian observed?

Previdian sensors have observed 30 exploitation attempts, 10 unique attacker IPs, and 7 countries targeting CVE-2026-51886. First observed Aug 15, 2026; last observed Sep 20, 2026.

Which versions are affected?

Version-level data is not available; Previdian tracks Langflow-ai langflow.

How should organizations remediate it?

Prioritize immediate patching and validate internet-facing exposure. Monitor for matching exploitation attempts in your environment.

No. CVE-2026-51886 is not currently listed in CISA KEV.

CVE-2026-51886 Exploitation Observed — langflow

Decision summary

What security teams need to know first

Direct answers before the deeper technical record.

What it is

CVE-2026-51886 is an unauthenticated vulnerability affecting Langflow-ai langflow. langflow-ai langflow v1.9.3 is affected by: Code Injection. The impact is: execute arbitrary code (remote). The component is:...

Is it exploited?

Yes. Previdian sensors observed exploitation attempts with confirmed confidence.

Who is affected?

Langflow-ai / langflow.

What should we do?

Patch immediately, validate internet-facing exposure, and monitor for matching requests.

Overview

langflow-ai langflow v1.9.3 is affected by: Code Injection

langflow-ai langflow v1.9.3 is affected by: Code Injection. The impact is: execute arbitrary code (remote). The component is: src/backend/base/langflow/api/v1/validate.py:validate-post_validate_code-a-real-authenticated-http-post-to-api-v1. The attack vector is: Attack surface: HTTP or browser-backed service path.

A public-facing route accepts raw Python source and forwards it into a server-side compile/exec validation path without any visible entitlement guard. ¶¶ A weakness has been identified in langflow-ai langflow up to 1.9.3. langflow contains a code injection vulnerability in validate-post_validate_code-a-real-authenticated-http-post-to-api-v1 (src/backend/base/langflow/api/v1/validate.py:13). An authenticated attacker can execute arbitrary Python code on the server by submitting malicious code to the /api/v1/validate/code endpoint, which directly executes user-supplied code without sandboxing or security controls.

Published: 01 Oct 2026
Exploitation Reported: 15 Aug 2026
Attack vector: Remote
Complexity: Low
Privileges: None
User interaction: None

CVE References

CVE Record CVE.org · CVE Record https://www.cve.org/CVERecord?id=CVE-2026-51886
GitHub — langflow-ai/langflow github.com · CVE Record https://github.com/langflow-ai/langflow/issues/13336
gist.github.com/Ro1ME/c11b1e63e4e8fca6b25275144f25ec2a gist.github.com · CVE Record https://gist.github.com/Ro1ME/c11b1e63e4e8fca6b25275144f25ec2a

Exploitation evidence

Why Previdian marks this CVE as exploited

Third-party attestation and first-party sensor observation are shown separately so teams can judge the evidence chain.

Exploited in the wild

Previdian

Recorded 15 Aug 2026

Previdian independently recorded this as exploited after first seeing it in honeypot sensors.

Active exploitation observed

Previdian sensor

First observed 15 Aug 2026

Previdian first observed exploitation attempts targeting this vulnerability in our honeypot sensors.

Known exploited vulnerability sources

Per-source evidence links for KEV attestations are available through the Previdian Pro API.

Learn about Pro API access

Source	Added
Previdian Sensors First	2026-10-06 10:31 UTC

Operational indicators for this CVE are listed under Detection.

Sensor telemetry

First-party evidence of exploitation activity

Previdian sensors recorded exploitation attempts targeting this vulnerability. The cards and chart show volume, unique attackers, and daily activity.

30

Attempts observed

10

Unique attacker IPs

7

Attacker countries

DK · ID · MY · NL · RU · SE · US

2

Sensors observed

CVE-2026-51886 exploitation attempts over the last 56 days

Daily events observed by Previdian sensors

Updated 08 Oct 2026

0

3

0

1

0

1

0

23

0

1

0

14 Aug 26 Aug 7 Sep 19 Sep 8 Oct

First observed 15 Aug 2026 · Last observed 20 Sep 2026

Pro adds sensor region and window summaries. Enterprise adds raw IPs, paths, User-Agents, and payloads.

Start 14-day Pro trial

Detection

Operational artifacts and observed signals

Make the evidence actionable in scanner, SOC, and edge-control workflows.

Observed signals

Request targets
User-Agents
Callback hosts: 1; 3; 0

Request targets and User-Agents available in Pro. Callback host details available in Enterprise.

Scanner coverage

No scanner integrations recorded yet.

Virtual patch status

No Previdian virtual patch is currently available. Future rules ship for ModSecurity, Cloudflare, and AWS WAF.

Learn about virtual patches →

Attacker IP Indicators

Attacker IP indicators observed · available in Pro and Enterprise.

Sensor-derived attacker IP indicators are available to Pro and Enterprise accounts under Detection and through the Pro API.

Learn about Pro API access

Risk and context

Severity, weaknesses, and research context

CVSS v3.1

9.8 Critical

Potential damage if exploited. Separate from whether attackers are using it.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.4%

Estimated chance of exploitation in the next 30 days. Previdian's warning comes from evidence, not this score.

Weaknesses

Improper Control of Generation of Code ('Code Injection') CWE-94

Recent mention · Github Advisory Database (PIP)

05 Oct 2026

[langflow] Langflow: Title Authenticated Remote Code Execution in validate_code via Malicious Decorators Description

###Summary: A critical Authenticated Remote Code Execution (RCE) vulnerability exists in the validate_code function of Langflow. The /api/v1/validate/code endpoint, meant to validate user-supplied code, leverages Python's exec() function. While it attempts to restrict...

Read full advisory

All Mentions

Recent mention · Github Advisory Database (PIP)

[langflow] Langflow: Title Authenticated Remote Code Execution in validate_code via Malicious Decorators Description

Github Advisory Database (PIP) · 05 Oct 2026

###Summary: A critical Authenticated Remote Code Execution (RCE) vulnerability exists in the validate_code function of Langflow. The /api/v1/validate/code endpoint, meant to validate user-supplied code, leverages Python's exec() function. While it attempts to restrict execution to function definitions, it fails to account for decorators, which are evaluated at definition time. This allows any authenticated user to execute arbitrary code on the server, resulting in a full system compromise. Details The vulnerability is located in src/lfx/src/lfx/custom/validate.py(exposed via...

Recent mention · Github Advisory Database (PIP)

[langflow] Duplicate Advisory: Title Authenticated Remote Code Execution in validate_code via Malicious Decorators Description

Github Advisory Database (PIP) · 02 Oct 2026

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-w584-2h2r-2hvf. This link is maintained to preserve external references. Original Description langflow-ai langflow v1.9.3 is affected by: Code Injection. The impact is: execute arbitrary code (remote). The component is: src/backend/base/langflow/api/v1/validate.py:validate-post_validate_code-a-real-authenticated-http-post-to-api-v1. The attack vector is: Attack surface: HTTP or browser-backed service path. A public-facing route accepts raw Python source and forwards it into a server-side compile/exec...

Timeline

From disclosure to observed exploitation

06 Oct 2026
00:20 UTC

Added to the Previdian watchlist

Pro and Enterprise Watch users had 10 hours of early warning before Previdian confirmed it as a KEV.
01 Oct 2026
00:00 UTC

CVE published

Vulnerability disclosed publicly
14 Sep 2026
03:56 UTC

Indicators of compromise added (7)

Indicators of compromise recorded
15 Aug 2026
02:06 UTC

Observed by Previdian sensors

Evidence-backed exploitation signal
08 Jun 2026
00:00 UTC

CVE ID reserved

Identifier reserved by the CNA

Pro API

Automate this intelligence

Confidence, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

Start 14-day Pro trial Read API docs

Evidence confidence and provenance
First-party sensor telemetry
PoC and scanner references
Affected versions and enrichment
Automation-ready JSON delivery

GET /api/v2/pro/kevs/CVE-2026-51886

Free JSON includes basic KEV fields

{
  "cve_id": "CVE-2026-51886",
  "confidence": "Confirmed",
  "cvss_score": 9.8,
  "cvss_estimated": false,
  "epss_score": 0.00403,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": true
  },
  "sensor_telemetry": { "attempts": 30, "sensors": 2 }
}

CVE-2026-51886

langflow-ai langflow v1.9.3 is affected by: Code Injection

Tags

CVE References

Exploited in the wild

Active exploitation observed

Known exploited vulnerability sources

Observed signals

Scanner coverage

Virtual patch status

Attacker IP Indicators

Weaknesses

[langflow] Langflow: Title Authenticated Remote Code Execution in validate_code via Malicious Decorators Description

All Mentions

Added to the Previdian watchlist

CVE published

Indicators of compromise added (7)

Observed by Previdian sensors

CVE ID reserved

Automate this intelligence