Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

IBM Langflow OSS allows remote signed‑in user to run code

CVE-2026-107327 · published 4 days ago
Summary

Versions 1.0.0 through 1.12.4 of IBM Langflow OSS do not properly check permissions, so a user who has logged in could cause the system to execute any program they choose. This could let an attacker take control of the server or steal data. Upgrade to the latest released version or apply the vendor's security patch as soon as possible.

What to do
  • Update langflow langflow to version 1.12.5 or later.
Affected software
VendorProductAffected versions
ibm langflow oss <= 1.12.4
langflow langflow >= 1.0.0, < 1.12.5
cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*
Original advisory text
Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to missing authorization.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-862Missing Authorization
Timeline
Published29 Oct 2026
Updated31 Oct 2026
First seen29 Oct 2026
Sources
CVE-2026-107327 · NVD
CVE-2026-107327 · MITRE
Track software like this
Free during beta