Langflow OSS: OS command injection enables remote code execution

Summary

IBM Langflow OSS versions 1.0.0 through 1.12.4 contain an OS command injection flaw (CWE-78). An authenticated remote attacker can inject operating system commands and execute arbitrary code on the server, with full impact on confidentiality, integrity and availability. Exploitation requires a valid user account on the Langflow instance.

Affected

• IBM Langflow OSS 1.0.0 to 1.12.4
• CVSS 3.1 base score 8.8 (CNA IBM), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Fixed in

• Upgrade to IBM Langflow OSS 1.12.5 (per the IBM Security Bulletin 7293016 and the CVE record)
• Before the upgrade, follow the Langflow release notes for preparation steps and configuration changes

Workaround

• IBM: for deployments using MCP stdio, set LANGFLOW_MCP_SERVER_INTERPRETER_HARDENING=true and LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY=true, then restart the Langflow service
• These controls do not replace the upgrade and may require changes to existing MCP server launch configurations
• Keep the default restriction on custom components for public workflows; enabling LANGFLOW_ALLOW_PUBLIC_CUSTOM_COMPONENTS weakens this protection

Exploitation

• No public exploitation of this CVE is known; CISA SSVC lists exploitation as none and automatable as no
• No public proof of concept was found in the sources reviewed
• Other Langflow CVEs from 2026 have been exploited in the wild, which is context only and not evidence of exploitation of this CVE

Our recommendation

• Upgrade all Langflow OSS instances from 1.0.0 to 1.12.4 to version 1.12.5 or later, and verify the fixed version against the IBM bulletin
• Inventory all Langflow instances, their versions and their network exposure before patching
• Restrict network access to the Langflow UI and API, and place it behind authentication or a reverse proxy
• Run the service as an unprivileged user with least-privilege credentials and rotate any API keys or secrets stored on the server if compromise is suspected
• Review user accounts and monitor for unusual command execution or outbound connections

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  rmhowe425/POC-CVE-2026-107326

Research sources

• IBM Security Bulletin 7293016: Langflow OSS is affected by multiple vulnerabilities www.ibm.com
• VulDB entry for the Langflow OSS vulnerability vuldb.com
• Strix CVE-2026-107326 details www.strix.ai
• CVE record snapshot at threatint cve.threatint.com
• OSV GHSA-8qpj-27x8-pwpq osv.dev

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 09:13.