High priorityDisclosed

Advisory · CVE-2026-110309

Authenticated remote code execution in Langflow via code generation

IBM Langflow OSS lets a remote authenticated attacker execute arbitrary commands through improper control of code generation. IBM rates it high at CVSS 8.8.

Advisory published October 29, 2026Independent summary
Vendor
IBM
Product
Langflow OSS
Identifier / CWE
CVE-2026-110309
CWE-94
Action timing
Immediate
ELI5

Explain it like I’m five

Langflow turns flow designs into code, but an authenticated attacker can steer what gets generated so the server ends up running the attacker's commands instead.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01Authenticated access

    A remote attacker holds any authenticated Langflow account.

  2. 02Code generation abused

    Attacker-controlled input steers Langflow code generation.

  3. 03Arbitrary command execution

    The generated code runs attacker commands on the Langflow host.

What happened

IBM lists CVE-2026-110309 in its Langflow OSS bulletin: a remote authenticated attacker can execute arbitrary commands due to improper control of code generation. IBM rates it high at CVSS 3.1 8.8.

IBM directs users to upgrade to Langflow OSS 1.12.5, which covers the flaws in this bulletin.

What to do

  1. Inventory Langflow deployments, including self-hosted, demo, and individually managed instances.
  2. Upgrade Langflow OSS to version 1.12.5 or later following the IBM bulletin.
  3. Restrict network access to Langflow while patching.
  4. Review application and host logs for unusual authenticated activity and unexpected processes.
  5. Rotate credentials and tokens that were reachable from affected servers if compromise cannot be excluded.

Management note

Patch alongside the rest of the Langflow bulletin. An 8.8 authenticated RCE in an AI builder is not a back-burner item.