CVE-2026-104324: Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to deserialization of untrusted data.
Other sources
Langflow OSS could allow a remote authenticated attacker to execute arbitrary code due to deserialization of untrusted data.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Langflow OSSto a version that resolves this vulnerability.Fixed in 1.12.4 - Operational
Back up the existing Langflow OSS installation before upgrading.
- Operational
Test your flows after installing Langflow OSS version 1.12.4.
Event History
Frequently Asked Questions
Which deployments should be prioritized for review?
Review IBM Langflow OSS deployments running versions 1.0.0 through 1.12.3. The listed impact is high, including confidentiality, integrity, and availability effects.
Does exploitation require authentication?
Yes. The vulnerability is described as exploitable by a remote authenticated attacker; no user interaction is required.
What level of access could successful exploitation provide?
A successful attacker could execute arbitrary code through deserialization of untrusted data.