IBM Langflow OSS: Code injection enables remote code execution

Summary

IBM Langflow OSS, the open-source edition of the Langflow platform for orchestrating language models, contains a code injection flaw (CWE-94) in its handling of OS commands. According to the CVE record, a remote attacker can execute arbitrary code on the server, which can fully compromise its confidentiality, integrity and availability. The NVD record lists no privileges required, but the sources conflict on whether authentication is needed, so treat the flaw as potentially unauthenticated until IBM clarifies. The same IBM bulletin lists several other Langflow OSS vulnerabilities in the same version range.

Affected

• IBM Langflow OSS (open-source edition) 1.0.0 through 1.12.2

Fixed in

• Upgrade to Langflow OSS 1.12.3 or later. IBM released 1.12.4 later; it is the newer release.

Workaround

Unknown. No vendor-documented workaround. Until patched, restrict access to the Langflow interface and keep it off the public internet.

Exploitation

• No confirmed exploitation in the wild. CISA SSVC lists exploitation as none and automatable as yes.
• Not listed in the CISA KEV catalog according to the research notes.
• A public Metasploit module exists for an authenticated Langflow command injection flaw; it is unconfirmed whether it covers this CVE.

Our recommendation

• Inventory all Langflow OSS instances, including versions and internet exposure.
• Upgrade to version 1.12.3 or later, preferably 1.12.4.
• Remove direct internet exposure, place Langflow behind a VPN or authenticated reverse proxy, and review which accounts exist.
• Rotate LLM provider keys and other secrets stored in affected instances if they may have been reachable.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  rmhowe425/POC-CVE-2026-93674
• Metasploit module exploit/multi/http/langflow_auth_command_injection_cve_2026_93674 – Langflow AI Auth Blind Command Injection

Research sources

• IBM Security Bulletin: Langflow OSS is affected by multiple vulnerabilities www.ibm.com
• OSV: CVE-2026-93674 osv.dev
• GBHackers: IBM patches multiple Langflow OSS flaws gbhackers.com
• Red Packet Security: CVE alert for IBM Langflow OSS www.redpacketsecurity.com
• Rapid7: Metasploit wrap-up (Langflow) www.rapid7.com
• DEV: CVE-2026-93674 and the credential risk in self-hosted LLM platforms dev.to

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 20:52.