High priorityDisclosed

Advisory · CVE-2026-107326

Authenticated OS command injection in Langflow

IBM Langflow OSS 1.0.0 through 1.12.4 lets a remote authenticated attacker execute arbitrary code through improper neutralization of special elements used in an OS command. IBM rates it high at CVSS 8.8.

Advisory published October 29, 2026Independent summary
Vendor
IBM
Product
Langflow OSS
Identifier / CWE
CVE-2026-107326
CWE-78
Action timing
Immediate
ELI5

Explain it like I’m five

Langflow passes user input into a system command without scrubbing it. An authenticated attacker adds extra commands to the input and the operating system runs them.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01Authenticated access

    A remote attacker holds any authenticated Langflow account.

  2. 02Command injection

    Attacker input carrying OS command syntax reaches a system command unneutralized.

  3. 03Arbitrary code execution

    The injected commands run on the Langflow host.

What happened

IBM disclosed CVE-2026-107326 in Langflow OSS versions 1.0.0 through 1.12.4: a remote authenticated attacker can execute arbitrary code due to improper neutralization of special elements used in an OS command. IBM rates it high at CVSS 3.1 8.8, with low privileges required and no user interaction.

IBM directs users to upgrade to Langflow OSS 1.12.5, which covers the flaws in this bulletin.

What to do

  1. Inventory Langflow deployments, including self-hosted, demo, and individually managed instances.
  2. Upgrade Langflow OSS to version 1.12.5 or later following the IBM bulletin.
  3. Restrict network access to Langflow while patching.
  4. Review application and host logs for unusual authenticated activity and unexpected processes.
  5. Rotate credentials and tokens that were reachable from affected servers if compromise cannot be excluded.

Management note

Patch with the rest of the Langflow bulletin. Command injection with a low-privileged account is a short path to host compromise.