CVE-2026-81204

IBM Langflow OSS versions 1.0.0 through 1.11.5 contain a code injection flaw (CWE-94) that occurs during graph construction, the process by which Langflow builds executable AI/agent workflow graphs. Because the CVSS 3.1 vector is network-exploitable with low complexity, no privileges, and no user interaction, a remote attacker who can reach the service can inject and execute arbitrary code on the underlying server without authenticating. Successful exploitation gives full control of the host — confidentiality, integrity, and availability are all rated high impact — and typically exposes any API keys, model credentials, or data configured in Langflow flows. All organizations running self-hosted IBM Langflow OSS in the affected range are at risk, especially instances exposed to the internet. As of now there is no known public proof of concept, no confirmed in-the-wild exploitation, and the flaw is not on the CISA KEV list, though the severity makes pre-patching attention warranted.

What to do: Upgrade IBM Langflow OSS to a release newer than 1.11.5 as soon as a fixed version is available from IBM. If patching must wait, remove the instance from internet exposure (place behind a VPN or authenticated reverse proxy) since exploitation requires no credentials or user interaction. Review logs for unauthenticated requests to graph-construction/flow endpoints and for unexpected Python process or outbound network activity originating from the Langflow server.