IBM Langflow OSS: Missing authorization allows remote code execution
Summary
IBM Langflow OSS versions 1.0.0 through 1.12.4 contain a missing authorization flaw (CWE-862). A remote attacker with a valid, low-privileged account can execute arbitrary code on the server. The IBM record does not name the vulnerable feature. Code execution would run with the privileges of the Langflow process, which typically holds LLM API keys and flow data.
Affected
- IBM Langflow OSS 1.0.0 to 1.12.4
Fixed in
- Upgrade to IBM Langflow OSS 1.12.5 (IBM CVE record and bulletin 7293016). Confirm the fixed version on the IBM page before relying on it.
Workaround
Unknown whether a workaround mitigates this CVE. IBM recommends the following controls for deployments using MCP stdio, in addition to the upgrade, and they do not replace it:
- Set LANGFLOW_MCP_SERVER_INTERPRETER_HARDENING=true
- Set LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY=true
- Restart the Langflow service after changing the environment configuration. These settings can require changes to existing MCP server launch configurations.
- Keep the default restriction on custom components for public workflows. Enabling LANGFLOW_ALLOW_PUBLIC_CUSTOM_COMPONENTS removes this protection.
Exploitation
- No known exploitation in the wild. CISA SSVC: exploitation none, automatable no.
- No public exploit found at the time of research.
- EPSS 0.66 % (percentile 52).
Our recommendation
- Upgrade Langflow OSS to 1.12.5 or later and test your flows afterwards.
- Patch the whole Langflow installation, since IBM published 33 Langflow CVEs on the same day.
- Restrict network access to the Langflow UI and API, and limit accounts to trusted users.
- Apply the MCP stdio controls if MCP stdio is used.
- Rotate LLM API keys and other secrets stored in flows if the instance was exposed to untrusted users.
- Monitor for unexpected code execution and unknown accounts.
Public exploits
Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.
- Proof of concept on GitHub (1 repositories)
rmhowe425/POC-CVE-2026-107327
Research sources
- IBM Security Bulletin 7293016 www.ibm.com
- CVE-2026-107327 (threatint) cve.threatint.com
- VulDB entry 428496 vuldb.com
- Langflow 1.13.0 upgrade campaign (HOL Guard) hol.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 09:14.
Original description (NVD)
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to missing authorization.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.