Advisory · CVE-2026-97655
Langflow's code security scanner can be bypassed through an incomplete blocklist
Langflow OSS releases 1.0.0 through 1.12.2 let a remote authenticated attacker execute arbitrary code by slipping past the code security scanner's incomplete blocklist. IBM rates it high at CVSS 8.8.
- Vendor
- IBM
- Product
- Langflow OSS
- Identifier / CWE
- CVE-2026-97655
CWE-94 - Action timing
- Immediate
Explain it like I’m five
Langflow has a guard who checks code against a list of forbidden tricks. This flaw means the list is missing some tricks, so a logged-in attacker can walk past the guard using a trick that is not on the list.
- 01Authenticated access
A remote attacker authenticates to Langflow with valid, low-privilege credentials.
- 02Blocklist evasion
The attacker crafts code using constructs the scanner's incomplete blocklist does not cover.
- 03Scanner passes
The code security scanner approves the payload because none of its patterns match.
- 04Arbitrary code runs
The unblocked code executes with the privileges of the Langflow service process.
What happened
IBM disclosed CVE-2026-97655 on October 7, 2026: an incomplete blocklist in Langflow OSS’s code security scanner, in versions 1.0.0 through 1.12.2. The scanner exists to stop dangerous code from being executed, but its denylist misses constructs an attacker can use, so a remote authenticated attacker can evade it and reach arbitrary code execution. IBM scores it high at CVSS 3.1 8.8.
A bypassable security control is worse than no control in one respect: teams rely on the scanner’s approval as evidence that a flow is safe. Any flow that passed the scanner during the vulnerable window deserves a second look.
IBM’s bulletin lists no workarounds or mitigations for these Langflow flaws; it recommends addressing them by upgrading.
What to do
- Inventory every Langflow deployment and confirm the running version.
- Upgrade affected instances (1.0.0 through 1.12.2) to the fixed release named in the IBM bulletin.
- Until patched, restrict network access to Langflow and review who holds accounts.
- Audit flows and components approved by the scanner during the vulnerable window for constructs the blocklist would have missed.
- Review application and system logs for code execution from low-privilege accounts, and rotate credentials if exploitation cannot be excluded.
Management note
Blocklist security is brittle by design, and this is the receipt. The scanner’s past approvals are no longer trustworthy on their own, so the upgrade needs a companion audit of what the scanner already let through.