Langflow OSS: Missing authorization allows code execution via code component
Summary
IBM Langflow OSS versions 1.0.0 through 1.12.4 contain a missing authorization flaw (CWE-862). An authenticated user with a low-privilege account can bypass the administrator-only restriction on built-in code-execution components. By configuring such a component with crafted inputs, the attacker can execute arbitrary code on the server. The CVSS base score is 8.8 (high), with high impact on confidentiality, integrity and availability. Risk is highest where Langflow is internet-facing or where accounts are shared or self-registered.
Affected
- IBM Langflow OSS 1.0.0 through 1.12.4
Fixed in
- Upgrade to Langflow OSS 1.12.5 (per IBM CVE record).
- Third-party sources list 1.13.0 as the latest cumulative fix. Verify on the IBM bulletin before rollout.
Workaround
- No specific workaround is documented for this CVE. Upgrading is required.
- For deployments using MCP stdio, IBM additionally recommends setting LANGFLOW_MCP_SERVER_INTERPRETER_HARDENING=true and LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY=true and restarting the service. These controls do not replace the upgrade.
Exploitation
- CISA SSVC: exploitation none, not automatable, total technical impact.
- No public proof of concept found. Not known to be exploited as of publication.
- EPSS 0.49 % (percentile 42).
Our recommendation
- Upgrade Langflow OSS to 1.12.5 or later (third parties recommend 1.13.0) and treat this as high priority if the instance is exposed or shared.
- Limit accounts to required users, remove unneeded low-privilege accounts and disable self-registration.
- Keep Langflow off the public internet where possible.
- Review flows that use code-execution components for unexpected changes and monitor the server for unusual commands.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- IBM Security Bulletin 7293016 www.ibm.com
- HOL Blog: CVE-2026-93680 Langflow upgrade guidance hol.org
- VulDB entry 428579 vuldb.com
- OffSeq Radar: CVE-2026-110196 radar.offseq.com
- Strix: CVE-2026-110196 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 09:13.
Original description (NVD)
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker with a low-privileged authenticated account to bypass the administrator-only restriction and execute arbitrary code on the server by configuring a built-in code-execution component with attacker-supplied inputs.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.