IBM's 2 October bulletin covers 25 Langflow CVEs, two of them unauthenticated 9.8 RCEs. Every release through 1.12.2 is affected; there is no workaround.
IBM published a security bulletin on 2 October 2026 covering 25 vulnerabilities in Langflow OSS. Every release from 1.0.0 through 1.12.2 is affected, the fix is 1.12.3, and the bulletin lists no workarounds. Two of the flaws, CVE-2026-104334 and CVE-2026-93674, score 9.8 on CVSS 3.1 and need no login and no user interaction. Anyone running Langflow, particularly an instance reachable from the internet, should treat the upgrade as urgent.
What was disclosed
The bulletin lists 25 CVEs, all scored by IBM as the CVSS source. By severity that is 2 critical, 19 high and 4 medium, and SecurityOnline counts 15 that can lead to code execution. The acknowledgement section is blank, so no discoverers are credited. IBM does not report exploitation in the wild, and SecurityOnline says no public proof of concept has been confirmed.
The two critical entries:
- CVE-2026-104334 (CWE-94, improper control of code generation): remote code execution, network-reachable, no privileges, no user interaction.
- CVE-2026-93674 (CWE-94): remote OS command injection leading to code execution, with the same 9.8 vector and no authentication required.
A third unauthenticated entry, CVE-2026-93675 (CWE-440, dependency confusion, 8.8), leads to code execution but requires a user to take an action.
The rest of the batch
Most of the remaining flaws need a logged-in account, which on a shared Langflow instance can be any flow author. They include:
- Code execution paths for authenticated users: a sandbox escape (CVE-2026-97676), an incomplete blocklist in the code security scanner (CVE-2026-97655), several input-validation and code-generation flaws at 8.1 to 8.8 (for example CVE-2026-97678, CVE-2026-97673, CVE-2026-97679, CVE-2026-88962), and an improper access control flaw scored 8.8 (CVE-2026-104335).
- Path traversal (CVE-2026-97677, CVE-2026-103360, CVE-2026-93448, CVE-2026-97671). IBM describes CVE-2026-97677 as letting a flow author write and read arbitrary files.
- Information disclosure and access control flaws, including insufficiently protected credentials (CVE-2026-101331) and caching access control (CVE-2026-97680).
- CVE-2026-93447, deserialization of a malicious Redis cache value, which requires the server secret and Redis write access (CVSS 7.5, high attack complexity).
- CVE-2026-93679, a denial of service from uncontrolled resource use while extracting ZIP archives (4.3).
Why this matters
Langflow has a record of being exploited, and TF has covered several of the earlier flaws, including CVE-2026-33017, two MCP stdio flaws and Google's count of exploited flaws. CISA added CVE-2025-3248, a missing-authentication flaw, to its KEV catalog in May 2025 and has since confirmed ransomware use. More recently CVE-2026-0770, an unauthenticated code execution flaw in the validate endpoint, was exploited from 27 June 2026 (KEVIntel recorded more than 220 attempts from 64 IPs) and entered KEV on 21 July. CVE-2026-33017 (March 2026) and CVE-2026-55255 (July 2026) are also in KEV. Attackers already probe Langflow, and a Langflow server typically holds model API keys and database credentials, so a code execution bug there is a credential theft bug.
Langflow's exploitation history leading to the 1.12.3 bulletin.
What defenders should do
- Upgrade to Langflow 1.12.3. IBM lists no workaround and strongly recommends the upgrade.
- Until then, SecurityOnline advises keeping Langflow off the public internet and limiting who can create or edit flows. That is not an IBM-endorsed mitigation.
- After patching, rotate API keys and credentials stored in the platform, since several flaws expose files, configs and secrets.
- Check for exposed instances and review logs for unexpected requests to code-validation and file endpoints, and for unfamiliar flows.
- If you use Redis for caching, restrict write access and protect the server secret (CVE-2026-93447).