Langflow 1.0.0 to 1.12.4: two IBM bulletins of 2026-10-19 list thirty CVEs, one unauthenticated 9.8 RCE (CVE-2026-104339); fixed 1.12.4 and 1.12.5

View raw markdownEdit on GitHub ↗

TL;DR

IBM published two Langflow OSS bulletins on 2026-10-19 that this corpus had not recorded: sixteen CVEs for 1.0.0 through 1.12.3 fixed in 1.12.4 (PyPI 2026-09-29), among them CVE-2026-104339, a 9.8 unauthenticated OS command injection, and fourteen CVEs for 1.0.0 through 1.12.4 fixed in 1.12.5 (PyPI 2026-10-06), among them three 9.9 authenticated code-execution records (CVE-2026-107327, CVE-2026-107328, CVE-2026-107329). IBM published the thirty CVE records on 2026-10-29, the same day as the four records of its 2026-10-28 bulletin, so the GitHub Advisory Database shows them as one wave. The 2026-10-28 bulletin's fix is 1.13.0, so 1.12.4 and 1.12.5 are stepping stones; upgrade to 1.13.0, set the two MCP hardening variables IBM names, and rotate any credential that ever appeared in an exported flow.

What happened

Langflow's disclosure runs through IBM's PSIRT, and its bulletins lead the vendor's GitHub security tab by weeks (the September file and the 1.13.0 file record the same pattern). Two bulletins were published on 2026-10-19 with no CVE records behind them; the records arrived at CVE Services on 2026-10-29, when IBM also published the four records for its 2026-10-28 bulletin. The langflow database query, read 2026-11-02, shows 25 unreviewed rows on page 1, every one dated 2026-10-29 and every one "IBM Langflow OSS 1.0.0 through 1.12.3", "through 1.12.4" or "through 1.12.8"; page 2 was not walked this run. The Hacker News (2026-11-02) counts "29 other flaws" beside the four in the 10-28 bulletin and notes that none of IBM's records lists 1.13.0 as affected; this file counts thirty from the two bulletin pages.

Bulletin one (IBM node 7293015, published 2026-10-19): Langflow OSS 1.0.0 through 1.12.3, fixed 1.12.4.

CVE IBM CVSS 3.1 IBM's one-line description
CVE-2026-104339 9.8 remote code execution via OS command injection, no authentication required (CWE-94, as IBM's page prints it). The CNA record (IBM, 2026-10-29): "could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command."
CVE-2026-104324 8.8 authenticated remote code execution via deserialization of untrusted data (CWE-502)
CVE-2026-104328 8.8 authenticated remote code execution via OS command injection (CWE-94, as IBM's page prints it)
CVE-2026-101288 8.8 authenticated remote code execution via code injection (CWE-94)
CVE-2026-103092 8.5 an authenticated user can execute arbitrary SQL commands due to improper access control (CWE-284)
CVE-2026-104317 8.1 remote code execution via deserialization by an attacker who can reach the message broker (CWE-502)
CVE-2026-104316 6.5 any authenticated user can cancel other users' background workflow jobs (CWE-285)
CVE-2026-104314 6.5 users with read or share access to a flow can retrieve the owner's stored third-party credentials in plaintext via the API (CWE-522)
CVE-2026-77819 6.5 authenticated arbitrary file overwrite due to a path restriction failure (CWE-22)
CVE-2026-104309 6.5 authenticated sensitive information disclosure via path traversal (CWE-22)
CVE-2026-104331 5.4 SSRF allowing unauthorized requests from the system (CWE-918)
CVE-2026-102590 5.0 SSRF leading to sensitive information disclosure (CWE-918)
CVE-2026-104310 4.3 SSRF leading to sensitive information disclosure (CWE-918)
CVE-2026-104315 4.3 SSRF allowing unauthorized requests from the server, potentially enabling network enumeration (CWE-918)
CVE-2026-104308 4.3 authenticated denial of service via OS command injection (CWE-78)
CVE-2026-104312 3.5 a server-generated ZIP can contain path-traversal entries (CWE-22)

IBM lists no workaround for bulletin one and asks for a backup and a release-notes review before the upgrade.

Bulletin two (IBM node 7293016, published 2026-10-19): Langflow OSS 1.0.0 through 1.12.4, fixed 1.12.5.

CVE IBM CVSS 3.1 IBM's one-line description
CVE-2026-107328 9.9 improper neutralization of code in eval/exec allows arbitrary code execution
CVE-2026-107329 9.9 improper control of code generation allows arbitrary code execution
CVE-2026-107327 9.9 missing authorization allows arbitrary code execution
CVE-2026-107326 8.8 OS command injection allows arbitrary code execution
CVE-2026-110309 8.8 improper control of code generation allows arbitrary command execution
CVE-2026-110196 8.8 a low-privileged user can bypass the admin-only restriction and execute code via a built-in code-execution component
CVE-2026-107366 8.3 message endpoints lack ownership checks: authenticated users can delete, overwrite or hijack others' messages and sessions (fixed in 1.9.0 per the bulletin)
CVE-2026-110245 7.5 improper authentication lets a remote attacker obtain sensitive information without credentials
CVE-2026-90991 6.5 unbounded resource allocation, authenticated denial of service
CVE-2026-110190 6.5 directory traversal lets an authenticated user view arbitrary files
CVE-2026-110244 6.5 a path restriction flaw lets an authenticated attacker obtain sensitive information
CVE-2026-110200 6.5 sensitive information stored in cleartext
CVE-2026-77817 6.5 secrets are not properly sanitized during flow and project exports (fixed in 1.11.5 per the bulletin)
CVE-2026-18894 6.5 stored Python component code in public workflows runs under the flow owner's context on the server (fixed in 1.11.2 per the bulletin)

Bulletin two names two mitigations for MCP stdio deployments that "do not replace the upgrade": set LANGFLOW_MCP_SERVER_INTERPRETER_HARDENING=true and LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY=true and restart. It also says to rotate any credentials that appear in previously exported files, because upgrading does not remove secrets already exported.

The releases. langflow 1.12.4 reached PyPI on 2026-09-29 at 20:13 UTC and 1.12.5 on 2026-10-06 at 20:08 UTC, twenty and thirteen days before the bulletins. Neither release page names a CVE. 1.12.4's notes carry "fix(auth): replace Passlib with bcrypt on release-1.12.4", "fix(mcp): reject direct Node runtime options in stdio configs", "fix(ssrf): pin direct Requests helper connections", "fix: block known pickle deserializers in generated components", "fix: hide stored flow credentials from shared readers" and "fix(security): protect Bing Search URL from run tweaks". 1.12.5's notes carry "fix(security): restrict built-in code execution to administrators", "fix(security): confine stored chat attachments to authorized storage", "fix(a2a): enforce authenticated execution policy", "fix(mcp): redact server credentials from management responses" and "fix(deps): upgrade vulnerable dependencies for 1.12.5". This file does not pair release-note lines with CVE ids, because neither IBM nor the release does.

Where this sits among the Langflow files here. The September bulletin (eleven CVEs, bulletin 2026-09-08, fixed 1.11.6, PyPI 2026-09-01) and these two (fixed 1.12.4 and 1.12.5) are followed by the 2026-10-28 bulletin (seven CVEs, fixed 1.13.0, PyPI 2026-10-22), so a reader on 1.12.5 is still one bulletin behind. None of the thirty ids is in CISA's KEV catalog as of its 2026-10-30 release; the catalog's six Langflow entries are CVE-2025-3248, CVE-2025-34291, CVE-2026-33017, CVE-2026-55255, CVE-2026-0770 and CVE-2026-9198. Langflow's own security tab, read on 2026-10-30, had no entry for any of these ids.

Severity. critical on IBM's 9.8 for an unauthenticated OS command injection and three 9.9s; patched rests on the vendor's bulletins and the two releases, with The Hacker News as the second source for the count and the fix versions.

Am I affected?

pip show langflow 2>/dev/null | grep -i ^version        # below 1.12.4: all thirty; 1.12.4: the fourteen of bulletin two; below 1.13.0: the 2026-10-28 bulletin's seven
docker image ls | grep langflowai/langflow
grep -rn 'LANGFLOW_MCP_SERVER_INTERPRETER_HARDENING\|LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY' .env docker-compose*.yml 2>/dev/null
  • Any instance below 1.12.4 that an untrusted network can reach is affected by CVE-2026-104339 (unauthenticated RCE). Any instance below 1.12.5 so reachable is affected by CVE-2026-110245 (unauthenticated information disclosure).
  • Any instance below 1.12.5 with accounts you do not fully trust is affected by the authenticated code-execution records, the credential reads and the export leak.
  • Any instance that ever exported flows or projects on an affected release has secrets in those exports that the upgrade does not remove.

If you are affected

  1. Back up the database, the secret key and uploaded files, then upgrade to 1.13.0 (pip install --upgrade "langflow==1.13.0" or the langflowai/langflow:1.13.0 image), following the auto-login recovery steps in the 1.13.0 file. 1.12.4 and 1.12.5 close these thirty but leave the 10-28 bulletin's seven open.
  2. Set LANGFLOW_MCP_SERVER_INTERPRETER_HARDENING=true and LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY=true where MCP stdio servers are configured, and restart.
  3. Rotate every credential stored in the instance or present in any exported flow or project file: rotating cloud credentials, if your web app was compromised. An unauthenticated instance that was reachable before 1.12.4 should be treated as compromised.

Prevention

  • Keep Langflow off the public internet and behind your own authentication, and treat every code-executing component as a shell for whoever can reach it: agent sandboxing.
  • Fewer long-lived provider keys inside the flow builder, and no exports with secrets in them: credential hygiene.

Sources