Critical Langflow Flaws Allow Unauthenticated Code Execution
Four flaws in Langflow 1.0.0-1.12.8 enable unauthenticated RCE and auth bypass; upgrade to 1.13.0 fixes them.
75
Vulnerability1 · 1 read
CVE-2026-110186
Remote code execution in IBM Langflow OSS 1.0.0–1.12.8
- CVSS 3.1
- 9.8 critical
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
IBM Langflow OSS 1.0.0 through 1.12.8 does not properly control code generation, allowing arbitrary code execution. A remote attacker can trigger it over the network with no authentication and no user interaction. Successful exploitation gives full control of the host. Deployments running those Langflow OSS versions are affected; IBM has not listed a fixed version.
What to do: Apply IBM's update for CVE-2026-110186. No workaround is named.
| Product | Affected |
|---|---|
| IBM Langflow OSS | 1.0.0 through 1.12.8 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to execute arbitrary code due to improper control of code generation.