IBM Langflow OSS: Remote code execution via deserialization of untrusted data
Summary
IBM Langflow OSS versions 1.0.0 through 1.12.3 deserialize untrusted data unsafely. A remote attacker with any valid Langflow account can execute arbitrary code on the server, with the privileges of the Langflow service. The vendor rates the issue CVSS 8.8 and no user interaction is required.
Affected
- IBM Langflow OSS 1.0.0 through 1.12.3
Fixed in
- Upgrade to IBM Langflow OSS 1.12.4 (vendor-recommended fix).
- Some secondary sources report that 1.13.0 also covers this CVE and the wider batch. IBM has not confirmed this in the sources reviewed.
Workaround
Unknown. No vendor workaround is documented for this CVE.
- Restrict Langflow access to trusted users and keep it off the public internet, or place it behind SSO or a VPN.
Exploitation
- No evidence of active exploitation of this specific CVE was found.
- CISA SSVC assessment: exploitation none, not automatable.
- CISA KEV status was not verified.
- No public proof of concept was found.
Our recommendation
- Identify all Langflow OSS instances and check their versions.
- Upgrade to at least 1.12.4 as soon as possible, following the vendor's upgrade instructions and backing up the installation first.
- Rotate credentials for model providers, databases and other secrets stored on the instance.
- Review user accounts for unknown or shared logins and restrict access to trusted users.
- Check whether the instance is reachable from the internet and, if so, remove direct exposure.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- IBM Security Bulletin: Langflow OSS is affected by multiple vulnerabilities www.ibm.com
- Langflow v1.12.4 release notes github.com
- CVE-2026-104324 details (threatint) cve.threatint.com
- Strix: CVE-2026-104324 www.strix.ai
- Dark Reading: Critical Langflow flaw exploited in attacks www.darkreading.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 09:16.
Original description (NVD)
IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to deserialization of untrusted data.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.