IBM Langflow OSS: Arbitrary SQL command execution via improper access control
Summary
IBM Langflow OSS versions 1.0.0 through 1.12.3 contain an improper access control flaw that allows a remote attacker with a valid user account to execute arbitrary SQL commands. Successful exploitation could allow an attacker to read, modify or delete data in the underlying database. NVD lists a CVSS score of 8.8, while IBM lists 8.5 with a scope change for this CVE.
Affected
- IBM Langflow OSS 1.0.0 through 1.12.3
Fixed in
- Upgrade to Langflow OSS 1.12.4 (IBM CNA record).
- A later IBM bulletin (7294467) reportedly recommends 1.13.0; this has not been verified.
Workaround
- No workaround is listed by IBM.
- Until the upgrade is done, keep Langflow off the public internet.
- Restrict access to trusted users and networks and review existing accounts.
- Rotate credentials if misuse is suspected.
Exploitation
- No known exploitation.
- CISA SSVC: exploitation none, not automatable.
- EPSS 0.37 % (percentile 31).
Our recommendation
- Check whether Langflow OSS 1.0.0 to 1.12.3 is in use, including test and development instances.
- Upgrade to Langflow OSS 1.12.4 or later and test your flows after the update.
- Restrict network access to Langflow and review user accounts and permissions.
- Monitor logs for unusual database queries or access after the upgrade.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- IBM Security Bulletin 7293015 www.ibm.com
- IBM Security Bulletin 7294467 www.ibm.com
- GitHub Security Advisory GHSA-vwmf-pq79-vjvx github.com
- VulDB 428492 vuldb.com
- Red Packet Security CVE alert www.redpacketsecurity.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 09:17.
Original description (NVD)
IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper access control.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.