CVE-2026-12944: IBM Langflow Root RCE — Detection, IMDS SSRF Containment, and Remediation Guide

---
title: Langflow Python Component SSRF to Cloud Instance Metadata
id: 9d2b7c41-2f6a-4d0d-9a31-7e4f5c6a8b90
status: experimental
description: Detects Python processes associated with Langflow initiating HTTP access to the cloud instance metadata service, consistent with CVE-2026-12944 IMDSv1 credential theft.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-12944
  - https://attack.mitre.org/techniques/T1552/005/
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/02/06
tags:
  - attack.credential_access
  - attack.t1552.005
  - attack.initial_access
  - attack.t1190
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    DestinationIp:
      - '169.254.169.254'
    DestinationPort:
      - 80
  filter_langflow_context:
    Image|endswith:
      - '/python'
      - '/python3'
      - '/python3.11'
      - '/python3.12'
    CommandLine|contains:
      - 'langflow'
  condition: selection and filter_langflow_context
falsepositives:
  - Rare legitimate metadata reads by Langflow plugins; investigate any UID 0 or interactive-session context immediately
level: critical
---
title: Suspicious Python Execution From Langflow Component Context
id: 4a1f8d2e-8b3c-4e21-9f70-2b6c7d8e9f01
status: experimental
description: Detects Python process launches with Langflow context and imports or command strings associated with socket/urllib abuse, arbitrary file access, or shell staging.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-12944
  - https://attack.mitre.org/techniques/T1059/006/
author: Security Arsenal
date: 2026/02/06
tags:
  - attack.execution
  - attack.t1059.006
logsource:
  category: process_creation
  product: linux
detection:
  selection_langflow:
    CommandLine|contains:
      - 'langflow'
  selection_python_risk:
    CommandLine|contains:
      - 'import socket'
      - 'from socket import'
      - 'import urllib'
      - 'urllib.request'
      - 'http://169.254.169.254'
      - '/latest/meta-data/iam/security-credentials'
      - 'open(/etc/'
      - 'subprocess'
      - 'os.system'
      - 'bash -c'
      - 'sh -c'
  condition: selection_langflow and selection_python_risk
falsepositives:
  - Developer testing in isolated labs; production Langflow component submission should be tightly controlled
level: high
---
title: Langflow Workload East-West Connection to PostgreSQL or Redis
id: 6c3e9a17-5b44-4a6f-81d2-0f9a8b7c6d5e
status: experimental
description: Detects Langflow-associated Python processes initiating internal connections to PostgreSQL or Redis after component execution, indicating possible lateral movement within container networks.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-12944
  - https://attack.mitre.org/techniques/T1021/
  - https://attack.mitre.org/techniques/T1210/
author: Security Arsenal
date: 2026/02/06
tags:
  - attack.lateral_movement
  - attack.t1021
  - attack.exploitation_remote_services
  - attack.t1210
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    DestinationPort:
      - 5432
      - 6379
  filter_python:
    Image|endswith:
      - '/python'
      - '/python3'
      - '/python3.11'
      - '/python3.12'
  filter_context:
    CommandLine|contains:
      - 'langflow'
  condition: selection and filter_python and filter_context
falsepositives:
  - Expected Langflow integrations to approved databases; alert when source, destination, user, or time deviates from baseline
level: medium

let metadataIp = "169.254.169.254";
let dbPorts = dynamic([5432, 6379]);
union isfuzzy=true
(DeviceNetworkEvents
| where RemoteIP == metadataIp or RemotePort in (dbPorts)
| where InitiatingProcessFileName has "python" or InitiatingProcessCommandLine has "langflow"
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName, RemoteIP, RemotePort, ActionType, LocalIP, LocalPort
),
(CommonSecurityLog
| where DestinationIP == metadataIp or DestinationPort in (dbPorts)
| where Message has "langflow" or Message has "python" or ProcessName has "python"
| project TimeGenerated, DeviceVendor, DeviceProduct, SourceIP, SourcePort, DestinationIP, DestinationPort, ProcessName, Message
),
(Syslog
| where SyslogMessage has "langflow" and (SyslogMessage has "169.254.169.254" or SyslogMessage has "5432" or SyslogMessage has "6379" or SyslogMessage has "urllib" or SyslogMessage has "socket")
| project TimeGenerated, Computer, HostIP, Facility, SeverityLevel, ProcessName, SyslogMessage
)
| order by TimeGenerated desc;

-- Hunt for Langflow Python processes with metadata-service or database egress
LET proc = SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ 'langflow|python'
   OR Name =~ 'python'

LET conns = SELECT Pid, Family, Type, Laddr, Lport, Raddr, Rport, Status
FROM netstat()
WHERE Raddr =~ '169\\.254\\.169\\.254'
   OR Rport in (5432, 6379)

SELECT proc.Pid AS Pid,
       proc.Ppid AS Ppid,
       proc.Name AS ProcessName,
       proc.Username AS Username,
       proc.CommandLine AS CommandLine,
       proc.CreateTime AS ProcessStart,
       conns.Raddr AS RemoteAddress,
       conns.Rport AS RemotePort,
       conns.Status AS ConnectionStatus
FROM proc
JOIN conns ON proc.Pid = conns.Pid
ORDER BY ProcessStart DESC

#!/usr/bin/env bash
set -euo pipefail

# Identify Langflow containers/processes and versions
printf '[*] Langflow processes:\n'
ps -eo user,uid,pid,ppid,comm,args | grep -i '[l]angflow' || true
printf '\n[*] Docker images/containers that look like Langflow:\n'
if command -v docker >/dev/null 2>&1; then
  docker ps --format '{{.ID}} {{.Image}} {{.Names}} {{.Ports}}' | grep -i langflow || true
  docker images --format '{{.Repository}} {{.Tag}} {{.ID}}' | grep -i langflow || true
fi

# Check for dangerous runtime posture
printf '\n[*] Root-running Langflow containers:\n'
if command -v docker >/dev/null 2>&1; then
  for c in $(docker ps -q); do
    img=$(docker inspect -f '{{.Config.Image}}' "$c" 2>/dev/null || true)
    user=$(docker inspect -f '{{.Config.User}}' "$c" 2>/dev/null || true)
    if printf '%s' "$img" | grep -qi langflow && [ -z "$user" ]; then
      printf 'ROOT_OR_DEFAULT user container: %s image=%s name=%s\n' "$c" "$img" "$(docker inspect -f '{{.Name}}' "$c")"
    fi
  done
fi

# Detect metadata reachability and enforce IMDSv2 where possible
printf '\n[*] IMDS reachability test (should fail after egress controls):\n'
curl -m 2 -sS -o /dev/null -w '%{http_code}\n' http://169.254.169.254/latest/meta-data/ || true
if [ "${ENFORCE_IMDSV2:-0}" = "1" ] && command -v aws >/dev/null 2>&1; then
  IID=$(curl -m 2 -s http://169.254.169.254/latest/meta-data/instance-id || true)
  if [ -n "$IID" ]; then
    aws ec2 modify-instance-metadata-options --instance-id "$IID" --http-tokens required --http-endpoint enabled --http-put-response-hop-limit 1 || true
  fi
fi

# Host egress example: block metadata from Langflow cgroup is preferable; minimal host OUTPUT fallback shown for lab use only
printf '\n[*] Add iptables owner match only if Langflow runs under dedicated user langflowsvc:\n'
if [ "${APPLY_IPTABLES:-0}" = "1" ] && id langflowsvc >/dev/null 2>&1; then
  iptables -C OUTPUT -m owner --uid-owner langflowsvc -d 169.254.169.254/32 -p tcp --dport 80 -j DROP 2>/dev/null || \
  iptables -A OUTPUT -m owner --uid-owner langflowsvc -d 169.254.169.254/32 -p tcp --dport 80 -j DROP
fi

# Kubernetes/Container hardening reminders rendered as checks
printf '\n[*] Required posture: non-root user, readOnlyRootFilesystem, drop ALL capabilities, no privileged mode, NetworkPolicy deny egress to 169.254.169.254 and default-deny east-west, secrets via external secret manager, no hostPath Docker socket.\n'