plaincve:~$

// threat brief

CVE-2026-104334

IBM Langflow OSS code injection: a remote attacker could run arbitrary code on the server

CVSS
9.8 CRITICAL
CISA KEV
Not listed
Weakness
CWE-94
Topics
AI security

PlainCVE Team · Published 2026-10-07 · AI-assisted · Press brief ↓

AI review 2026-10-07 (not human-reviewed)Command tests: none yetReproduced: not yetVerification record ↓

Langflow OSS 1.0.0–1.12.2 doesn't properly control code generation, so a remote attacker could run arbitrary code on the server; upgrade to 1.12.3.

Who is affectedOrganizations running IBM Langflow OSS 1.0.0 through 1.12.2 where an attacker can reach the instance over the network.
What happensAn attacker could run arbitrary code on the server. The CVSS score rates the impact on confidentiality, integrity and availability as High. IBM's bulletin summary says the real impact depends on how Langflow is deployed.
What to do nowUpgrade Langflow OSS to 1.12.3, as IBM recommends in its security bulletin and the CVE record. Until then, keep Langflow unreachable from untrusted networks (PlainCVE's suggestion).
Affected versions1.0.0 through 1.12.2
Fixed versions1.12.3 (IBM security bulletin)
CVSS vector
Show full vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Timeline
  • First public 2026-10-02

Blue team playbook

Check, fix / mitigate, respond, harden. Matching the affected versions does not mean you were compromised, and a check that finds nothing does not prove you are safe; each item says what it can and cannot show. Tagged steps point to where the attack flow below can be stopped.

DETECTCheckAm I affected? Any signs of compromise?
  1. 01Check your version and exposure

    You are in scope if your Langflow OSS version is between 1.0.0 and 1.12.2 and the instance is reachable by an attacker over the network.

    Step 1
  2. 02No official indicators of compromise to check against

    No source reports exploitation in the wild, and none of the sources we reviewed provides indicators of compromise. If your instance was exposed, PlainCVE suggests checking the server for unexpected processes, files or outbound connections.

    Step 3Step 4
MITIGATEFix / mitigatePatch; block it if you cannot patch yet
  1. 01Upgrade to 1.12.3

    IBM's security bulletin (Remediation/Fixes) and the CVE record both strongly recommend upgrading to 1.12.3; the maintainers released 1.12.3 on 2026-09-22. One news article says no patch has been released, but IBM's bulletin lists 1.12.3 as the fixed version.

    Step 2Step 3
  2. 02Before upgrading: restrict network access

    No source gives an official workaround for this CVE. PlainCVE suggests making Langflow reachable only from trusted internal networks in the meantime.

    Step 1
RESPONDRespondIf you find signs of compromise
  1. 01Treat the server as untrusted if you suspect compromise

    None of the sources we reviewed gives response guidance for this CVE. PlainCVE suggests: if an affected version was exposed and you see suspicious activity, isolate the host, preserve logs, and rotate the keys and credentials stored on the server. This is a precaution, not a confirmation of any leak.

    Step 4
HARDENHardenPrevent the next one
  1. 01Don't expose Langflow directly to the internet

    IBM's bulletin summary says impact depends on deployment configuration; reducing network exposure lowers the risk from flaws like this (PlainCVE's suggestion).

    Step 1
  2. 02Run with least privilege

    Even if code is executed, what the attacker can reach stays limited (PlainCVE's suggestion).

    Step 4
Full remediation steps and notes
  1. Upgrade to 1.12.3. The Remediation/Fixes section of IBM’s security bulletin lists 1.12.3 as the fixed version, and the CVE record gives the same advice. The 1.12.3 release notes list many security fixes (including code-scanner and sandbox changes), but none names CVE-2026-104334, and no source says which change fixes it.
  2. About the “no patch yet” news report. One news article (TheHackerWire) says no patch has been released, but IBM’s bulletin lists 1.12.3 as the fixed version, and the maintainers released 1.12.3 on 2026-09-22.
  3. No official workaround. IBM’s bulletin lists “None” under Workarounds and Mitigations. Restricting network access until you upgrade is PlainCVE’s suggestion.

Attack flow

Read left to right: this is the order the attack happens in. A blue shield means the step can be stopped; the earlier, the better. Click an icon for details.

Read top to bottom: this is the order the attack happens in. A blue shield means the step can be stopped; the earlier, the better. Tap an icon for details.

IBM Langflow OSS code injection: a remote attacker could run arbitrary code on the server: 1. Reaches the Langflow instance over the network → 2. Langflow fails to properly control how code is generated → 3. The server runs code the attacker can influence → 4. The attacker may run arbitrary code on the server (actual impact depends on deployment)CVE-2026-104334 · IBM Langflow OSS code injection: a remote attacker could run arbitrarycode on the serverAttackerYour systemReaches the Langflow instance over the network — The vendor describes a "remote attacker". The CVSS vector sets Privileges Required to None (PR:N), meaning no login is needed, though no source says "unauthenticated" in plain words. 1Reaches theLangflow instanceover the networkLangflow fails to properly control how code is generated — This is CWE-94 (code injection). The sources don't say which feature or what kind of input is involved. 2Langflow fails toproperly controlhow code isgeneratedThe server runs code the attacker can influence — No action by a victim is needed (UI:N in the CVSS vector). 3The server runscode the attackercan influenceThe attacker may run arbitrary code on the server (actual impact depends on deployment) — An attacker could run arbitrary code on the server. IBM's bulletin summary notes the actual impact depends on deployment configuration. 4The attacker mayrun arbitrary codeon the server(actual impac…Attack pathCan be stopped herePlainCVE · plaincve.date/en/vulns/cve-2026-104334-langflow-code-injection-rce · CC BY 4.0
IBM Langflow OSS code injection: a remote attacker could run arbitrary code on the server: 1. Reaches the Langflow instance over the network → 2. Langflow fails to properly control how code is generated → 3. The server runs code the attacker can influence → 4. The attacker may run arbitrary code on the server (actual impact depends on deployment)CVE-2026-104334 · IBM Langflow OSS codeinjection: a remote attacker could runarbitrary code on the serverReaches the Langflow instance over the network — The vendor describes a "remote attacker". The CVSS vector sets Privileges Required to None (PR:N), meaning no login is needed, though no source says "unauthenticated" in plain words. 1AttackerReaches the Langflow instanceover the networkLangflow fails to properly control how code is generated — This is CWE-94 (code injection). The sources don't say which feature or what kind of input is involved. 2Your systemLangflow fails to properlycontrol how code is generatedThe server runs code the attacker can influence — No action by a victim is needed (UI:N in the CVSS vector). 3Your systemThe server runs code theattacker can influenceThe attacker may run arbitrary code on the server (actual impact depends on deployment) — An attacker could run arbitrary code on the server. IBM's bulletin summary notes the actual impact depends on deployment configuration. 4AttackerThe attacker may run arbitrarycode on the server (actualimpact depends on deployment)Attack pathCan be stopped herePlainCVE · CC BY 4.0plaincve.date/en/vulns/cve-2026-104334-langflow-code-injection-rce
Free to use in reporting and teaching under CC BY 4.0. Attribution is already on the image.
  1. Attacker

    Reaches the Langflow instance over the network

    The vendor describes a "remote attacker". The CVSS vector sets Privileges Required to None (PR:N), meaning no login is needed, though no source says "unauthenticated" in plain words.

    Defense: Keep Langflow unreachable from untrusted networks (PlainCVE's suggestion).

  2. Your system

    Langflow fails to properly control how code is generated

    This is CWE-94 (code injection). The sources don't say which feature or what kind of input is involved.

    Defense: Upgrade to 1.12.3.

  3. Your system

    The server runs code the attacker can influence

    No action by a victim is needed (UI:N in the CVSS vector).

    Defense: Upgrade to 1.12.3.

  4. Attacker

    The attacker may run arbitrary code on the server (actual impact depends on deployment)

    An attacker could run arbitrary code on the server. IBM's bulletin summary notes the actual impact depends on deployment configuration.

    Defense: Run the service with a low-privilege account and limit the secrets stored on the server (PlainCVE's suggestion).

Who is affected

ConditionAffected?
Langflow OSS 1.0.0 through 1.12.2, reachable by an attacker over the networkAffected
Langflow OSS 1.12.3Fixed version (IBM security bulletin)
Versions before 1.0.0Not stated by the sources

Both IBM’s security bulletin (Affected Products and Versions section) and the CVE record list 1.0.0–1.12.2 as affected. IBM’s bulletin covers many Langflow OSS vulnerabilities at once, so match it against the CVE ID when reading it.

How it works

IBM’s description is that Langflow OSS could allow a remote attacker to execute arbitrary code due to “improper control of code generation”. This kind of problem is classed as CWE-94 (code injection): a program mixes outside input into code it then runs, letting an outsider decide what the server executes.

The sources don’t say which feature or what kind of input is involved. The CVSS vector AV:N/AC:L/PR:N/UI:N means: over the network, low complexity, no privileges needed (that is, no login), and no victim action. However, no source says “unauthenticated” in plain words; TheHackerWire only says it is “highly probable” the flaw can be exploited without logging in. IBM’s bulletin summary also notes that the real impact depends on deployment configuration, without saying which settings matter for this CVE.

Generic CWE-94 illustration (conceptual, not Langflow’s code):

Show code example(python)
# Flawed approach: running outside text as code
result = run_as_code(user_supplied_text)
Show code example(python)
# Safer approach: treat outside input only as data, never hand it to an interpreter
result = handle_as_data(user_supplied_text)

Timeline

DateEvent
2026-09-22Langflow maintainers release 1.12.3
2026-10-01CVE ID reserved
2026-10-02IBM publishes its security bulletin (first disclosure)
2026-10-06IBM (as CNA) publishes the CVE record
2026-10-07NVD publishes the entry (analysis still in progress); GitHub publishes unreviewed advisory GHSA-74xw-7rg4-6p4c

Comparing the dates, the fixed release 1.12.3 came out 10 days before IBM’s bulletin and 14 days before the CVE record.

Further reading

  • Scoring: IBM rates it CVSS 3.1 9.8 (Critical). NVD’s analysis was still in progress when it published the entry; the vector on this page comes from the CVE record.
  • Exploitation: as of 2026-10-07 it is not in CISA’s KEV catalog; no source reports exploitation in the wild, and no source says it was exploited before a patch existed. TheHackerWire says no standalone public exploit had been published when it wrote its article.
  • EPSS (per Strix’s page) estimates about a 0.62% chance of exploitation in the next 30 days.
  • Related weakness type: CWE-94.

Verification Checked item by item against sources by AI under our review rules, all passed; not human-reviewed and not yet reproduced in our lab

AI review2026-10-07 · review rules

Verification records describe the environment and the result only, never reproduction steps or code that could attack other people’s systems. See our policy.

Sources

  1. AdvisorySecurity Bulletin: Langflow OSS is affected by multiple vulnerabilities · IBM, 2026-10-02 · accessed 2026-10-07
  2. CVE / NVD / OSVCVE-2026-104334 Record (CVE Services API) · CVE Program, 2026-10-06 · accessed 2026-10-07
  3. CVE / NVD / OSVNVD - CVE-2026-104334 · NIST, 2026-10-07 · accessed 2026-10-07
  4. AdvisoryGHSA-74xw-7rg4-6p4c (unreviewed) · GitHub, 2026-10-07 · accessed 2026-10-07
  5. Patch / releaseLangflow v1.12.3 release · langflow-ai (GitHub), 2026-09-22 · accessed 2026-10-07
  6. Patch / releaseLangflow v1.12.3 release (GitHub API) · langflow-ai (GitHub), 2026-09-22 · accessed 2026-10-07
  7. OtherCVE-2026-104334 · OpenCVE · accessed 2026-10-07
  8. NewsCVE-2026-104334: IBM Langflow OSS code generation flaw enables remote arbitrary code execution · TheHackerWire · accessed 2026-10-07
  9. ResearchCVE-2026-104334 · Strix · accessed 2026-10-07

Press brief

In one sentence

IBM has disclosed a critical flaw in Langflow OSS (CVE-2026-104334): versions 1.0.0 through 1.12.2 do not properly control code generation, which could let a remote attacker run arbitrary code on the server. IBM rates it CVSS 9.8 (Critical) and recommends upgrading to 1.12.3. As of October 7, 2026, it is not in CISA's Known Exploited Vulnerabilities catalog, and no source reports exploitation in the wild.

Key facts

Severity
CVSS 3.1 9.8 (Critical, IBM) ibm.com
Affected versions
1.0.0 through 1.12.2 cveawg.mitre.org
Fixed version
1.12.3 ibm.com
First disclosed (IBM security bulletin)
2026-10-02 ibm.com
CVE published
2026-10-06 (IBM as CNA) cveawg.mitre.org
EPSS
About 0.62% chance of exploitation in the next 30 days strix.ai

Confirmed

  • IBM confirms Langflow OSS improperly controls code generation, which could let a remote attacker run arbitrary code.
  • IBM's security bulletin and the CVE record both list 1.0.0 through 1.12.2 as affected; IBM's security bulletin lists 1.12.3 as the fixed version and recommends upgrading.
  • IBM's security bulletin was first published on 2026-10-02, before the CVE record on 2026-10-06.
  • As of 2026-10-07, it is not in CISA's Known Exploited Vulnerabilities catalog.

Unconfirmed / disputed

  • No source names the specific change in 1.12.3 that fixes this CVE.
  • No source reports exploitation in the wild, or says it was exploited before a patch existed.
  • IBM says impact depends on deployment configuration but does not say which settings matter for this CVE.

Quotable line

When software turns outside input into code it runs, a single flaw can be enough to let an attacker run arbitrary code on the server.

Images

Download the share image (PNG) · Attack flow diagram (downloadable)

Please credit "PlainCVE" and link to this page. Full citation format is under "How to cite" below. Found a factual error? Report it.

How to cite this page

This article is CC BY 4.0. Please keep the attribution and link when republishing.

PlainCVE Team (2026). "IBM Langflow OSS code injection: a remote attacker could run arbitrary code on the server". PlainCVE. https://plaincve.date/en/vulns/cve-2026-104334-langflow-code-injection-rce (accessed YYYY-MM-DD)
BibTeX
@misc{cve2026104334langflowcodeinjectionrce2026,
  title  = {IBM Langflow OSS code injection: a remote attacker could run arbitrary code on the server},
  author = {PlainCVE Team},
  year   = {2026},
  howpublished = {PlainCVE},
  url    = {https://plaincve.date/en/vulns/cve-2026-104334-langflow-code-injection-rce},
  note   = {Updated 2026-10-07}
}