Advisory · CVE-2026-93449
Authenticated cross-context code execution in Langflow code generation
Langflow OSS releases 1.0.0 through 1.12.2 let a remote authenticated attacker execute arbitrary code through improper control of code generation, with effects that cross the component's security scope. IBM rates it high at CVSS 8.5.
- Vendor
- IBM
- Product
- Langflow OSS
- Identifier / CWE
- CVE-2026-93449
CWE-94 - Action timing
- Immediate
Explain it like I’m five
Langflow builds code inside a safety box, but this flaw lets a logged-in user's input jump out of the box and run on the whole machine instead. The safety box turns out to have an open lid.
- 01Authenticated access
A remote attacker authenticates to Langflow with valid, low-privilege credentials.
- 02Payload into code generation
The attacker submits input that flows into Langflow's code generation path.
- 03Scope escape
The resulting code breaks the intended security scope of the vulnerable component, extending the attacker's reach beyond it.
- 04Arbitrary code runs
Attacker-controlled code executes with the privileges of the Langflow service process.
What happened
IBM disclosed CVE-2026-93449 on October 7, 2026: an improper control of code generation in IBM Langflow OSS versions 1.0.0 through 1.12.2. What sets this entry apart from its siblings is the changed scope: exploitation needs higher attack complexity and authenticated access, but the impact crosses the vulnerable component’s security boundary. IBM scores it high at CVSS 3.1 8.5.
Scope-changed flaws matter because the blast radius is not limited to the component that failed. Code that escapes its sandbox can reach neighboring flows, stored credentials, and other tenants on shared instances.
IBM’s bulletin lists no workarounds or mitigations for these Langflow flaws; it recommends addressing them by upgrading.
What to do
- Inventory every Langflow deployment, including shared and multi-tenant instances, and confirm the running version.
- Upgrade affected instances (1.0.0 through 1.12.2) to the fixed release named in the IBM bulletin.
- Until patched, restrict network access to Langflow and review who holds accounts on shared instances.
- Review application and system logs for unusual flow execution or code execution calls from low-privilege accounts.
- If exploitation cannot be excluded, rotate credentials held by or reachable from the Langflow host and review downstream systems.
Management note
A scope-crossing flaw on a shared AI platform is a multi-tenant incident waiting for confirmation. Patching fixes the boundary, but on shared instances also review what other flows and secrets the escaped code could have touched.