CVE-2026-90991: Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to cause a denial of service due to allocation of resources without limits or throttling.
Other sources
Langflow OSS could allow a remote authenticated attacker to cause a denial of service due to allocation of resources without limits or throttling.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Langflow OSSto a version that resolves this vulnerability.Fixed in 1.12.5 - Operational
Back up the existing Langflow OSS installation before upgrading.
- Operational
Test your flows after installing Langflow OSS version 1.12.5.
Event History
Frequently Asked Questions
Can an unauthenticated attacker exploit this issue?
The issue is described as requiring a remote authenticated attacker. The provided information does not identify which authenticated roles or permissions are sufficient.
What is the expected impact if the issue is exploited?
An attacker could cause a denial of service by triggering resource allocation without limits or throttling.