High priorityDisclosed

Advisory · CVE-2026-110196

Low-privileged users can run code in Langflow via admin-only component bypass

IBM Langflow OSS 1.0.0 through 1.12.4 lets a remote attacker with a low-privileged authenticated account bypass the administrator-only restriction and execute arbitrary code by configuring a built-in code-execution component. IBM rates it high at CVSS 8.8.

Advisory published October 29, 2026Independent summary
Vendor
IBM
Product
Langflow OSS
Identifier / CWE
CVE-2026-110196
CWE-862
Action timing
Immediate
ELI5

Explain it like I’m five

Langflow has a code-running component meant for administrators only, but the gate checking for admin rights can be sidestepped. A low-privileged user configures that component with their own inputs and gets code execution.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01Low-privileged account

    A remote attacker holds a low-privileged authenticated Langflow account.

  2. 02Admin-only restriction bypassed

    The attacker configures a built-in code-execution component despite the administrator-only restriction.

  3. 03Arbitrary code execution

    Attacker-supplied inputs run as code on the Langflow host.

What happened

IBM disclosed CVE-2026-110196 in Langflow OSS versions 1.0.0 through 1.12.4: a remote attacker with a low-privileged authenticated account can bypass the administrator-only restriction and execute arbitrary code on the server by configuring a built-in code-execution component with attacker-supplied inputs. IBM rates it high at CVSS 3.1 8.8, with low privileges required and no user interaction.

This one breaks the usual assumption that only admins are dangerous: any authenticated user, including self-registered or trial accounts where enabled, can reach code execution.

What to do

  1. Inventory Langflow deployments and review which accounts, including self-registered ones, can authenticate.
  2. Upgrade Langflow OSS to version 1.12.5 or later following the IBM bulletin.
  3. Restrict network access to Langflow and disable self-registration while patching if it is enabled.
  4. Review application and host logs for code-component configuration by non-admin accounts.
  5. Rotate credentials and tokens that were reachable from affected servers if compromise cannot be excluded.

Management note

Audit who can log in, not just who is an admin. On instances with open registration, this is effectively unauthenticated-adjacent RCE.