Advisory · CVE-2026-107329
Authenticated remote code execution in Langflow via code generation
IBM Langflow OSS 1.0.0 through 1.12.4 lets a remote authenticated attacker execute arbitrary code through improper control of code generation. IBM rates it critical at CVSS 9.9.
- Vendor
- IBM
- Product
- Langflow OSS
- Identifier / CWE
- CVE-2026-107329
CWE-94 - Action timing
- Immediate
Explain it like I’m five
Langflow lets users design flows that turn into code, but it does not keep a tight leash on what code gets generated. An authenticated attacker steers that generation into running their own commands.
- 01Authenticated access
A remote attacker holds any authenticated Langflow account.
- 02Code generation abused
Attacker-controlled input steers Langflow code generation.
- 03Arbitrary code execution
The generated code runs on the Langflow host.
What happened
IBM disclosed CVE-2026-107329 in Langflow OSS versions 1.0.0 through 1.12.4: a remote authenticated attacker can execute arbitrary code due to improper control of code generation. IBM rates it critical at CVSS 3.1 9.9, with low privileges required, no user interaction, and changed scope.
Because Langflow flows routinely connect to language models and external tools, code execution on the server can expose API keys, model credentials, and data reachable from the deployment.
What to do
- Inventory Langflow deployments, including self-hosted, demo, and individually managed instances.
- Upgrade Langflow OSS to version 1.12.5 or later following the IBM bulletin.
- Restrict network access to Langflow while patching.
- Review application and host logs for unusual flow creation and unexpected processes.
- Rotate credentials and tokens that were reachable from affected servers if compromise cannot be excluded.
Management note
Same-day patching for a 9.9 authenticated RCE in a widely deployed AI builder. Treat internet-facing instances as exposed until upgraded.