Advisory · CVE-2026-97678
Authenticated remote code execution in Langflow through input validation failure
Langflow OSS releases 1.0.0 through 1.12.2 let a remote authenticated attacker execute arbitrary code through improper input validation. IBM rates it high at CVSS 8.8.
- Vendor
- IBM
- Product
- Langflow OSS
- Identifier / CWE
- CVE-2026-97678
CWE-693 - Action timing
- Immediate
Explain it like I’m five
Langflow's front desk is supposed to inspect every package visitors bring in, but one entrance skips the inspection. A logged-in visitor can carry dangerous instructions through that entrance and have them carried out.
- 01Authenticated access
A remote attacker authenticates to Langflow with valid, low-privilege credentials.
- 02Malformed input
The attacker submits input that Langflow's validation does not properly check.
- 03Unchecked processing
The input flows into a processing path where it is treated as trusted.
- 04Arbitrary code runs
The attacker's instructions execute as code with the privileges of the Langflow service process.
What happened
IBM disclosed CVE-2026-97678 on October 7, 2026: an improper input validation flaw in IBM Langflow OSS versions 1.0.0 through 1.12.2 that lets a remote authenticated attacker reach arbitrary code execution. IBM scores it high at CVSS 3.1 8.8, with network access, low privileges, no user interaction, and full confidentiality, integrity, and availability impact.
This bulletin groups several validation and neutralization failures under the same product and version range. Each is a distinct reachable path to the same outcome: attacker code running as the Langflow service. Remediating one endpoint without upgrading the product leaves the others open.
IBM’s bulletin lists no workarounds or mitigations for these Langflow flaws; it recommends addressing them by upgrading.
What to do
- Inventory every Langflow deployment and confirm the running version.
- Upgrade affected instances (1.0.0 through 1.12.2) to the fixed release named in the IBM bulletin.
- Until patched, restrict network access to Langflow, review and prune accounts, and keep it off the public internet.
- Review application and system logs for unusual flow execution or code execution calls from low-privilege accounts.
- If exploitation cannot be excluded, rotate credentials held by or reachable from the Langflow host and review downstream systems.
Management note
Multiple distinct paths to the same code execution outcome means incident review cannot be scoped to one endpoint. Treat the whole instance as exposed, patch to the fixed release, and review logs across all flows.