IBM Langflow OSS: Arbitrary command execution via code generation
Summary
IBM Langflow OSS versions 1.0.0 through 1.12.4 contain a code injection flaw (CWE-94) that allows arbitrary command execution on the server. An attacker needs a valid user account on the Langflow instance, and the IBM bulletin describes the flaw as exploitable with low privileges. Successful exploitation would give the attacker the privileges of the Langflow process; the CVSS score is 8.8 (High).
Affected
- IBM Langflow OSS 1.0.0 through 1.12.4
Fixed in
- Upgrade to IBM Langflow OSS 1.12.5 (per IBM bulletin 7293016; not independently verified)
- Note: a secondary source references version 1.13.0 as the recommended target, which also covers 1.12.5 and later. Confirm on the IBM bulletin before acting.
Workaround
- IBM publishes no specific workaround for this CVE; upgrading is the fix.
- For deployments using MCP stdio, IBM recommends setting LANGFLOW_MCP_SERVER_INTERPRETER_HARDENING=true and LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY=true, then restarting the service. These controls do not replace the upgrade and may require changes to existing MCP server launch configurations.
- Keep LANGFLOW_ALLOW_PUBLIC_CUSTOM_COMPONENTS disabled (default).
Exploitation
- Not known to be exploited in the wild for this CVE, according to one tracker.
- Not listed in CISA KEV as far as checked.
- CISA SSVC assessment: Exploitation none, Automatable no, Technical Impact total.
- No public proof-of-concept found; the search was not exhaustive.
Our recommendation
- Inventory all Langflow OSS instances and verify their versions.
- Upgrade all affected instances to 1.12.5 or later (1.13.0 is referenced as the recommended target) and test flows after the upgrade.
- Apply the MCP stdio configuration controls if MCP stdio is used.
- Restrict user accounts, disable self-registration and auto-login where possible, and do not expose instances to the internet.
- Monitor logs for unusual command execution or account activity.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- IBM Security Bulletin 7293016 www.ibm.com
- IBM Security Bulletin 7294467 www.ibm.com
- HOL: CVE-2026-93680 Langflow upgrade to 1.13.0 hol.org
- Strix CVE-2026-110309 www.strix.ai
- OffSeq Radar CVE-2026-110309 radar.offseq.com
- SecurityWeek: Hackers start exploiting critical Langflow vulnerability www.securityweek.com
- The Hacker News: Langflow critical authenticated RCE thehackernews.com
- Langflow release notes 1.12.0 docs.langflow.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 09:12.
Original description (NVD)
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary commands due to improper control of code generation.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.