Advisory · CVE-2026-107328
Authenticated remote code execution in Langflow via eval and exec
IBM Langflow OSS lets a remote authenticated attacker execute arbitrary code through improper neutralization of code in eval and exec handling. IBM rates it critical at CVSS 9.9.
- Vendor
- IBM
- Product
- Langflow OSS
- Identifier / CWE
- CVE-2026-107328
CWE-94 - Action timing
- Immediate
Explain it like I’m five
Some Langflow paths run code with eval and exec, which execute text as program instructions. An authenticated attacker slips their own instructions into that text and the server runs them.
- 01Authenticated access
A remote attacker holds any authenticated Langflow account.
- 02Code passed to eval or exec
Attacker-controlled code reaches an eval or exec path without proper neutralization.
- 03Arbitrary code execution
The code runs on the Langflow host.
What happened
IBM lists CVE-2026-107328 in its Langflow OSS bulletin: a remote authenticated attacker can execute arbitrary code due to improper neutralization of code in eval and exec handling. IBM rates it critical at CVSS 3.1 9.9.
This flaw sits in the same bulletin family as the other Langflow code-execution flaws disclosed alongside it, and IBM directs users to upgrade to Langflow OSS 1.12.5.
What to do
- Inventory Langflow deployments, including self-hosted, demo, and individually managed instances.
- Upgrade Langflow OSS to version 1.12.5 or later following the IBM bulletin.
- Restrict network access to Langflow while patching.
- Review application and host logs for unusual authenticated activity and unexpected processes.
- Rotate credentials and tokens that were reachable from affected servers if compromise cannot be excluded.
Management note
A 9.9 authenticated RCE in a popular AI platform. Patch with the rest of the Langflow bulletin, same day.