IBM Patches Multiple Langflow OSS Flaws Including Two Critical RCE Vulnerabilities

IBM has disclosed 25 vulnerabilities in Langflow OSS, affecting versions 1.0.0 through 1.12.2. Two of these are critical flaws that allow unauthenticated remote code execution. The security bulletin recommends upgrading to version 1.12.3, and it does not list any workarounds.

Langflow provides a visual environment for building AI agents and workflows, featuring customization with Python components and built-in API and MCP servers. These capabilities position its code execution and data access safeguards at critical security boundaries.

IBM Patches Multiple Langflow OSS Flaws

The highest-rated vulnerabilities, CVE-2026-104334 and CVE-2026-93674, each have an IBM-assigned CVSS score of 9.8. The vulnerability vectors indicate they can be exploited remotely, with low attack complexity, no required privileges, and no user interaction necessary. This poses significant risks to confidentiality, integrity, and availability.

Most of the remaining execution vulnerabilities require the attacker to be authenticated. These include sandbox escape, inadequate input validation, code-generation controls, command-handling problems, and an incomplete security-scanner blocklist.

CVE-2026-93675 is an exception: it involves a dependency confusion scenario that requires user interaction but does not require attacker privileges, according to its vulnerability vector.

CVE-2026-97677 allows an authenticated flow author to write attacker-controlled content into directories writable by the service account, bypassing local file isolation. A specially crafted index on disk can also expose accessible configuration files, secrets, or application databases.

CVE-2026-97680 affects vertex result caching and could disclose sensitive information or allow injection of malicious data due to improper access controls.

Another cache-related issue, CVE-2026-93447, requires access to the server secret and Redis write permissions. Retrieving a malicious serialized cache value could execute attacker-controlled code with the service process’s privileges.

IBM has identified version 1.12.3 as the remediation release. IBM published this version on September 22, 2026, and followed it with version 1.12.4, released on September 29, 2026.

The bulletin provides no evidence of active exploitation, publicly available exploits, or confirmed compromises. The actual exposure depends on the deployment configuration and attacker access, and it is important to distinguish authenticated vulnerabilities from the two unauthenticated critical execution flaws.

CVE Details

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.