CVE-2026-107327: Langflow OSS is affected by multiple vulnerabilities

Q: What level of access does an attacker need?

Exploitation requires an authenticated account with low privileges. The available data does not indicate that unauthenticated attackers can exploit the issue.

Q: Does exploitation require user interaction or complex conditions?

The CVSS vector indicates network-based exploitation with low attack complexity and no user interaction required.

Q: What is the potential impact if exploitation succeeds?

The vulnerability is rated critical with high confidentiality, integrity, and availability impact. The CVSS vector also indicates a scope change.

Published Oct 29, 2026

Updated

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to missing authorization.

Affected Software

1 affected component

Langflow Langflow>=1.0.0<1.12.5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Langflow OSS to a version that resolves this vulnerability.
Fixed in 1.12.5
Operational
Back up the existing Langflow OSS installation before upgrading.
Operational
Test your flows after installing Langflow OSS version 1.12.5.

Event History

Oct 29, 2026

CVE Published

via MITRE·03:16 PM

Data Sourced

via MITRE·03:16 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·04:17 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:17 PM

RemedyAffected Software

Frequently Asked Questions

What level of access does an attacker need?

Exploitation requires an authenticated account with low privileges. The available data does not indicate that unauthenticated attackers can exploit the issue.

Does exploitation require user interaction or complex conditions?

The CVSS vector indicates network-based exploitation with low attack complexity and no user interaction required.

What is the potential impact if exploitation succeeds?

The vulnerability is rated critical with high confidentiality, integrity, and availability impact. The CVSS vector also indicates a scope change.

CVE-2026-107327: Langflow OSS is affected by multiple vulnerabilities

Affected Software

Remediation

Event History

Frequently Asked Questions

What level of access does an attacker need?

Does exploitation require user interaction or complex conditions?

What is the potential impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need?

Does exploitation require user interaction or complex conditions?

What is the potential impact if exploitation succeeds?