CVE-2026-18894: Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to trigger pre-existing stored Python component code in a public workflow, executing it under the flow owner's runtime context within the server process. This bypasses the intended trust boundary where public execution paths are restricted to server-trusted component code.
Other sources
Langflow OSS could allow a remote attacker to trigger pre-existing stored Python component code in a public workflow, executing it under the flow owner's runtime context within the server process. This bypasses the intended trust boundary where public execution paths are restricted to server-trusted component code.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Langflow OSSto a version that resolves this vulnerability.Fixed in 1.12.5 - Operational
Back up the existing Langflow OSS installation before upgrading.
- Operational
Test the flows after installing Langflow OSS 1.12.5.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments with public workflows that contain stored Python component code are implicated. The affected execution path is the public workflow path rather than the intended server-trusted-component-only boundary.
Does exploitation require an attacker to add new Python code to a workflow?
The described attack triggers pre-existing stored Python component code in a public workflow. The provided information does not state that the attacker must be able to create or modify that code.
What execution context would the triggered code receive?
The code executes in the flow owner's runtime context within the server process. This could expose privileges available to that owner and process context.