CVE-2026-110309: Langflow OSS is affected by multiple vulnerabilities

Published Oct 29, 2026

Updated

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary commands due to improper control of code generation.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Langflow OSS to a version that resolves this vulnerability.
Fixed in 1.12.5
Operational
Back up the existing Langflow OSS installation before upgrading.
Operational
Test your flows after installing Langflow OSS 1.12.5.

Event History

Oct 29, 2026

CVE Published

via MITRE·03:14 PM

Data Sourced

via MITRE·03:14 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·04:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

A remote attacker who is authenticated to an affected IBM Langflow OSS instance can exploit the vulnerability. The provided information does not indicate that unauthenticated attackers can use it.

Which versions are affected?

IBM Langflow OSS versions 1.0.0 through 1.12.4 are identified as affected.

What level of access could exploitation provide?

Successful exploitation could allow the authenticated attacker to execute arbitrary commands. The reported impact includes high confidentiality, integrity, and availability impact.