Advisory · CVE-2026-97673
Authenticated remote code execution in Langflow through input validation failure
Langflow OSS releases 1.0.0 through 1.12.2 let a remote authenticated attacker execute arbitrary code through improper input validation. IBM rates it high at CVSS 8.8.
- Vendor
- IBM
- Product
- Langflow OSS
- Identifier / CWE
- CVE-2026-97673
CWE-693 - Action timing
- Immediate
Explain it like I’m five
Langflow accepts building instructions from logged-in users but forgets to check that the instructions are safe before following them. A user can hand it dangerous instructions disguised as ordinary ones.
- 01Authenticated access
A remote attacker authenticates to Langflow with valid, low-privilege credentials.
- 02Malformed input
The attacker submits input that Langflow's validation does not properly check.
- 03Unchecked processing
The input flows into a processing path where it is treated as trusted.
- 04Arbitrary code runs
The attacker's instructions execute as code with the privileges of the Langflow service process.
What happened
IBM disclosed CVE-2026-97673 on October 7, 2026: an improper input validation flaw in IBM Langflow OSS versions 1.0.0 through 1.12.2 that lets a remote authenticated attacker reach arbitrary code execution. IBM scores it high at CVSS 3.1 8.8, with network access, low privileges, no user interaction, and full confidentiality, integrity, and availability impact.
Input validation failures are the classic shape of injection flaws: untrusted data crosses a trust boundary without being checked, and something downstream treats it as instructions. The full CIA impact in the score means the attacker gets total control of the service, not a partial read.
IBM’s bulletin lists no workarounds or mitigations for these Langflow flaws; it recommends addressing them by upgrading.
What to do
- Inventory every Langflow deployment and confirm the running version.
- Upgrade affected instances (1.0.0 through 1.12.2) to the fixed release named in the IBM bulletin.
- Until patched, restrict network access to Langflow, review and prune accounts, and keep it off the public internet.
- Review application and system logs for unusual flow execution or code execution calls from low-privilege accounts.
- If exploitation cannot be excluded, rotate credentials held by or reachable from the Langflow host and review downstream systems.
Management note
Full CIA impact at 8.8 with only a login required means every account on the instance is one bad day from total compromise. Patch the flaw, then make sure the account list reflects who actually needs access.