Advisory · CVE-2026-110186
Unauthenticated remote code execution in Langflow via code generation
IBM Langflow OSS 1.0.0 through 1.12.8 lets a remote attacker execute arbitrary code through improper control of code generation, with no authentication required. IBM rates it critical at CVSS 9.8.
- Vendor
- IBM
- Product
- Langflow OSS
- Identifier / CWE
- CVE-2026-110186
CWE-94 - Action timing
- Immediate
Explain it like I’m five
Langflow turns designs into code, and an attacker needs no account at all to steer that process. The generated code runs the attacker's instructions on the server.
- 01Unauthenticated request
A remote attacker sends a crafted request to Langflow with no login.
- 02Code generation abused
Attacker input steers Langflow code generation.
- 03Arbitrary code execution
The generated code runs on the Langflow host.
What happened
IBM disclosed CVE-2026-110186 in Langflow OSS versions 1.0.0 through 1.12.8: a remote attacker can execute arbitrary code due to improper control of code generation. IBM rates it critical at CVSS 3.1 9.8, with no privileges required, no user interaction, and unchanged scope.
Unauthenticated 9.8 RCE is the worst item in this Langflow batch. Any internet-facing instance on an affected version should be assumed reachable by attackers scanning for it.
What to do
- Inventory Langflow deployments, including self-hosted, demo, and individually managed instances.
- Upgrade Langflow OSS to version 1.13.0 or later following the IBM bulletin.
- Take internet-facing instances offline or behind strict access control until patched.
- Review application and host logs for unauthenticated requests and unexpected processes.
- Rotate credentials and tokens that were reachable from affected servers if compromise cannot be excluded.
Management note
Unauthenticated 9.8 RCE in a popular AI platform is an emergency patch, not a scheduled one. Internet-facing instances go first.