IBM Langflow OSS: Code injection via code generation enables remote code execution
Summary
IBM Langflow OSS versions 1.0.0 through 1.12.8 contain a code injection flaw (CWE-94) in how code is generated. A remote attacker can use it to execute arbitrary code on the server, with a CVSS 3.1 base score of 9.8 from IBM. The official record does not state that authentication is required, but a secondary source describes it as reachable without login, so treat every instance as exposed until verified. VulDB scores the issue lower (7.3), and the CVE record was published only recently.
Affected
- IBM Langflow OSS 1.0.0 through 1.12.8
Fixed in
- Upgrade to Langflow OSS 1.13.0 or later (per the CVE record's solution text; verify against IBM Security Bulletin 7294467).
- pip users: pip install langflow --upgrade
- Docker users: pull the latest tagged image.
Workaround
- No vendor workaround known.
- Disabling auto-login does not remove the risk according to a secondary source.
Exploitation
- Not known to be exploited as of 29 October 2026 (OffSeq).
- CISA SSVC: Exploitation none, Automatable yes, Technical Impact total.
- No public proof of concept found; this is unknown, not confirmed absent.
- Langflow is a frequent target in 2026, with other Langflow flaws exploited in the wild.
Our recommendation
- Inventory all Langflow OSS instances and their versions.
- Upgrade affected instances to 1.13.0 or later, after confirming the fix on IBM bulletin 7294467.
- Remove direct internet access to Langflow now, or place it behind a VPN or an authenticating reverse proxy until patched.
- Review logs for unexpected flow, code generation or component requests since the affected version was deployed.
- If exposure is confirmed, rotate stored API keys and cloud credentials on the instance.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- IBM Security Bulletin 7294467 www.ibm.com
- Strix CVE-2026-110186 www.strix.ai
- OffSeq CVE-2026-110186 radar.offseq.com
- VulDB CVE-2026-110186 vuldb.com
- Langflow auth bypass and RCE upgrade guidance (hol.org) hol.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 16:06.
Original description (NVD)
IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to execute arbitrary code due to improper control of code generation.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.