CVE-2026-78569

IBM Langflow OSS versions 1.0.0 through 1.11.5 contain an OS command injection flaw (CWE-78) in the product's built-in security scanner, where an incomplete denylist of characters or patterns fails to block crafted input. An authenticated attacker with low privileges can send a crafted request over the network, with no user interaction required, and the insufficiently filtered input is passed to the operating system, resulting in execution of arbitrary code. Successful exploitation yields high impact across confidentiality, integrity, and availability (CVSS 3.1 of 8.8), effectively allowing full compromise of the host or container running the Langflow service. All deployments running Langflow OSS 1.0.0 through 1.11.5 are affected, with risk concentrated in self-hosted instances used for AI/LLM application development. As of publication there is no public proof-of-concept, the issue is not in CISA KEV, and no in-the-wild exploitation has been reported.

What to do: Upgrade all Langflow OSS deployments beyond version 1.11.5 to the latest patched release as identified in IBM's advisory (a specific fixed version was not provided in this data, so confirm the fixed release with IBM/[email protected] before deploying). In the interim, restrict authentication to trusted users only and limit what the Langflow process can execute on the host, since exploitation requires valid credentials. Check your deployed version via the admin UI or container tag, and monitor IBM's advisory for confirmation of the fix.