CVE-2026-90991: IBM Langflow OSS vulnerability

Q: Can an unauthenticated attacker exploit this issue?

The issue is described as requiring a remote authenticated attacker. The provided information does not identify which authenticated roles or permissions are sufficient.

Q: What is the expected impact if the issue is exploited?

An attacker could cause a denial of service by triggering resource allocation without limits or throttling.

Published Oct 19, 2026

Updated

Langflow OSS could allow a remote authenticated attacker to cause a denial of service due to allocation of resources without limits or throttling.

Affected Software

1 affected component

IBM Langflow OSS<=1.0.0 - 1.12.4

Event History

Oct 19, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Parent advisories

This vulnerability appears in the following advisories.

IBM-7293016

Frequently Asked Questions

Can an unauthenticated attacker exploit this issue?

The issue is described as requiring a remote authenticated attacker. The provided information does not identify which authenticated roles or permissions are sufficient.

What is the expected impact if the issue is exploited?

An attacker could cause a denial of service by triggering resource allocation without limits or throttling.