CVE-2026-78571

IBM Langflow OSS versions 1.0.0 through 1.11.5 contain a code-injection flaw (CWE-94) in which an eval() call is applied to attacker-controlled input without any guarding or sanitization. A remote attacker who holds valid credentials — even low-privileged ones — can submit crafted input that reaches the eval() call, causing arbitrary code to execute on the server running Langflow. Successful exploitation gives the attacker full control of the Langflow process, with high impact on confidentiality, integrity, and availability, which is significant because Langflow instances typically hold API keys, model credentials, and connections to internal data sources for AI workflows. All deployments running IBM Langflow OSS 1.0.0 through 1.11.5 are affected; because authentication is required, instances that are exposed to the internet or shared with many users are at greater risk than tightly restricted ones. No public proof-of-concept is known and the flaw is not yet in CISA's KEV catalog, so there is no confirmed exploitation at this time.

What to do: Upgrade IBM Langflow OSS to the latest fixed release (any version newer than 1.11.5); the data does not name a specific fixed version, so check IBM's advisory for the exact patched release. Until you can upgrade, limit who can authenticate to Langflow, restrict network access to the service (VPN or firewall rules) and avoid exposing it directly to the internet, and check server logs for unexpected process or command activity by authenticated users.