High priorityDisclosed

Advisory · CVE-2026-104324

Authenticated remote code execution in Langflow via deserialization

IBM Langflow OSS 1.0.0 through 1.12.3 lets a remote authenticated attacker execute arbitrary code through deserialization of untrusted data. IBM rates it high at CVSS 8.8.

Advisory published October 29, 2026Independent summary
Vendor
IBM
Product
Langflow OSS
Identifier / CWE
CVE-2026-104324
CWE-502
Action timing
Immediate
ELI5

Explain it like I’m five

Langflow unpacks data it receives and trusts what is inside. An authenticated attacker sends a package that runs code the moment it is unpacked.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01Authenticated access

    A remote attacker holds any authenticated Langflow account.

  2. 02Untrusted data deserialized

    A crafted object is deserialized without trust checks.

  3. 03Arbitrary code execution

    The payload runs code on the Langflow host.

What happened

IBM disclosed CVE-2026-104324 in Langflow OSS versions 1.0.0 through 1.12.3: a remote authenticated attacker can execute arbitrary code due to deserialization of untrusted data. IBM rates it high at CVSS 3.1 8.8, with low privileges required and no user interaction.

IBM directs users to upgrade to Langflow OSS 1.12.5, which covers the flaws in this bulletin.

What to do

  1. Inventory Langflow deployments, including self-hosted, demo, and individually managed instances.
  2. Upgrade Langflow OSS to version 1.12.5 or later following the IBM bulletin.
  3. Restrict network access to Langflow while patching.
  4. Review application and host logs for unusual authenticated activity and unexpected processes.
  5. Rotate credentials and tokens that were reachable from affected servers if compromise cannot be excluded.

Management note

Patch with the rest of the Langflow bulletin. Deserialization RCE needs no user interaction beyond a low-privileged account.