Act nowDisclosed

Advisory · CVE-2026-107327

Authenticated remote code execution in Langflow via missing authorization

IBM Langflow OSS 1.0.0 through 1.12.4 lets a remote authenticated attacker execute arbitrary code because of missing authorization. IBM rates it critical at CVSS 9.9.

Advisory published October 29, 2026Independent summary
Vendor
IBM
Product
Langflow OSS
Identifier / CWE
CVE-2026-107327
CWE-862
Action timing
Immediate
ELI5

Explain it like I’m five

Langflow has a locked door that nobody actually checks. An authenticated visitor walks through it and runs their own commands on the server.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01Authenticated access

    A remote attacker holds any authenticated Langflow account.

  2. 02Missing authorization check

    A request reaches functionality without the authorization check it should have.

  3. 03Arbitrary code execution

    The attacker runs arbitrary code on the Langflow host.

What happened

IBM disclosed CVE-2026-107327 in Langflow OSS versions 1.0.0 through 1.12.4: a remote authenticated attacker can execute arbitrary code due to missing authorization. IBM rates it critical at CVSS 3.1 9.9, with low privileges required, no user interaction, and changed scope.

Langflow is a widely used visual builder for AI agents and flows, and its server typically runs with access to models, credentials, and connected data sources, so code execution on the host is a full compromise of the deployment, not just of one flow.

What to do

  1. Inventory Langflow deployments, including self-hosted, demo, and individually managed instances.
  2. Upgrade Langflow OSS to version 1.12.5 or later following the IBM bulletin.
  3. Restrict network access to Langflow while patching, and review accounts for unexpected privileged users.
  4. Review application and host logs for unusual authenticated activity and unexpected processes.
  5. Rotate credentials and tokens that were reachable from affected servers if compromise cannot be excluded.

Management note

A 9.9-rated authenticated RCE in a popular AI platform deserves same-day patching. Any internet-facing Langflow instance should be treated as exposed until upgraded.