Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Langflow OSS can run unauthorized code from public workflows

CVE-2026-18894 · published 4 days ago
Summary

Versions 1.0.0 through 1.12.4 of IBM Langflow OSS let a remote user place malicious Python code in a public workflow. When the workflow runs, that code executes with the same permissions as the workflow owner on the server. Update to a patched version or restrict public workflow creation until the fix is applied.

What to do
  • Update langflow langflow to version 1.12.5 or later.
Affected software
VendorProductAffected versions
ibm langflow oss <= 1.12.4
langflow langflow >= 1.0.0, < 1.12.5
cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*
Original advisory text
Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to trigger pre-existing stored Python component code in a public workflow, executing it under the flow owner's runtime context within the server process. This bypasses the intended trust boundary where public execution paths are restricted to server-trusted component code.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-94Code Injection
Timeline
Published29 Oct 2026
Updated1 Nov 2026
First seen29 Oct 2026
Sources
CVE-2026-18894 · NVD
CVE-2026-18894 · MITRE
Track software like this
Free during beta