Advisory · CVE-2026-104317
Remote code execution in Langflow via message broker deserialization
IBM Langflow OSS 1.0.0 through 1.12.3 lets a remote attacker who can reach the message broker execute arbitrary code through deserialization of untrusted data. IBM rates it high at CVSS 8.1.
- Vendor
- IBM
- Product
- Langflow OSS
- Identifier / CWE
- CVE-2026-104317
CWE-502 - Action timing
- Immediate
Explain it like I’m five
Langflow workers trust packages arriving through the message broker and unpack them without checking the sender. An attacker who can reach the broker slips in a package that runs code when unpacked.
- 01Broker reachable
An attacker reaches the Langflow message broker.
- 02Untrusted data deserialized
A crafted message is deserialized without trust checks.
- 03Arbitrary code execution
The payload runs code on the Langflow host.
What happened
IBM disclosed CVE-2026-104317 in Langflow OSS versions 1.0.0 through 1.12.3: a remote attacker who can reach the message broker can execute arbitrary code due to deserialization of untrusted data. IBM rates it high at CVSS 3.1 8.1, with no privileges required and high attack complexity.
The precondition matters here: the broker must be reachable by the attacker. Brokers that are accidentally exposed to a network, or shared with untrusted tenants, turn this into remote code execution.
What to do
- Inventory Langflow deployments and confirm the message broker is not reachable beyond trusted hosts.
- Upgrade Langflow OSS to version 1.12.5 or later following the IBM bulletin.
- Firewall the broker to trusted Langflow components only while patching.
- Review broker and host logs for unexpected messages and processes.
- Rotate credentials and tokens that were reachable from affected servers if compromise cannot be excluded.
Management note
Check broker exposure first, then patch. An exposed broker plus this flaw is remote code execution with no login needed.