Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-107329: Langflow OSS may let signed-in users run any code

CVE-2026-107329 · published 4 days ago

Summary

Versions 1.0.0 through 1.12.4 of IBM Langflow OSS can let someone who has logged in execute their own code on the server. This could let an attacker take control of the system or steal data. Upgrade to a newer, fixed version and limit who can log in to the application.

What to do

Update langflow langflow to version 1.12.5 or later.

Affected software

Vendor	Product	Affected versions
ibm	langflow oss	<= 1.12.4
langflow	langflow	>= 1.0.0, < 1.12.5 `cpe:2.3:a:langflow:langflow::::::::`

Original advisory text

Langflow OSS is affected by multiple vulnerabilities

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code generation.

References

https://www.ibm.com/support/pages/node/7293016 Patch Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

8.8 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-94Code Injection

Timeline

Published29 Oct 2026

Updated31 Oct 2026

First seen29 Oct 2026

Sources

CVE-2026-107329 · NVD

CVE-2026-107329 · MITRE

Track software like this

Free during beta