---
id: 2026-10-langflow-october-19-ibm-bulletins-thirty-cves-unauthenticated-rce-cve-2026-104339-fixed-1-12-4-1-12-5
title: "Langflow 1.0.0 to 1.12.4: two IBM bulletins of 2026-10-19 list thirty CVEs, one unauthenticated 9.8 RCE (CVE-2026-104339); fixed 1.12.4 and 1.12.5"
date_disclosed: 2026-10-19
last_updated: 2026-11-02
severity: critical
status: patched
ecosystems: [pypi, python, docker, agent-framework]
tools_affected: ["langflow (PyPI) 1.0.0 through 1.12.3 (sixteen CVEs, fixed 1.12.4) and 1.0.0 through 1.12.4 (fourteen CVEs, fixed 1.12.5), and the langflowai/langflow Docker image on the same lines", "any Langflow instance reachable by users who are not fully trusted, and any instance reachable from an untrusted network"]
tags: [cve, langflow, ibm-psirt, rce, command-injection, code-injection, deserialization, ssrf, path-traversal, credential-exposure, mcp-stdio, vendor-bulletin, patched]
---

## TL;DR
IBM published two Langflow OSS bulletins on 2026-10-19 that this corpus had not recorded: sixteen CVEs for 1.0.0 through 1.12.3 fixed in 1.12.4 (PyPI 2026-09-29), among them CVE-2026-104339, a 9.8 unauthenticated OS command injection, and fourteen CVEs for 1.0.0 through 1.12.4 fixed in 1.12.5 (PyPI 2026-10-06), among them three 9.9 authenticated code-execution records (CVE-2026-107327, CVE-2026-107328, CVE-2026-107329). IBM published the thirty CVE records on 2026-10-29, the same day as the four records of its 2026-10-28 bulletin, so the GitHub Advisory Database shows them as one wave. The 2026-10-28 bulletin's fix is 1.13.0, so 1.12.4 and 1.12.5 are stepping stones; upgrade to 1.13.0, set the two MCP hardening variables IBM names, and rotate any credential that ever appeared in an exported flow.

## What happened

Langflow's disclosure runs through IBM's PSIRT, and its bulletins lead the vendor's GitHub security tab by weeks ([the September file](2026-09-langflow-ibm-psirt-eleven-cve-batch.md) and [the 1.13.0 file](2026-10-langflow-1-13-0-ibm-bulletin-seven-cves-auth-bypass-code-generation-rce.md) record the same pattern). Two bulletins were published on 2026-10-19 with no CVE records behind them; the records arrived at CVE Services on 2026-10-29, when IBM also published the four records for its 2026-10-28 bulletin. The `langflow` database query, read 2026-11-02, shows 25 unreviewed rows on page 1, every one dated 2026-10-29 and every one "IBM Langflow OSS 1.0.0 through 1.12.3", "through 1.12.4" or "through 1.12.8"; page 2 was not walked this run. The Hacker News (2026-11-02) counts "29 other flaws" beside the four in the 10-28 bulletin and notes that none of IBM's records lists 1.13.0 as affected; this file counts thirty from the two bulletin pages.

**Bulletin one (IBM node 7293015, published 2026-10-19): Langflow OSS 1.0.0 through 1.12.3, fixed 1.12.4.**

| CVE | IBM CVSS 3.1 | IBM's one-line description |
|---|---|---|
| CVE-2026-104339 | 9.8 | remote code execution via OS command injection, no authentication required (CWE-94, as IBM's page prints it). The CNA record (IBM, 2026-10-29): "could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command." |
| CVE-2026-104324 | 8.8 | authenticated remote code execution via deserialization of untrusted data (CWE-502) |
| CVE-2026-104328 | 8.8 | authenticated remote code execution via OS command injection (CWE-94, as IBM's page prints it) |
| CVE-2026-101288 | 8.8 | authenticated remote code execution via code injection (CWE-94) |
| CVE-2026-103092 | 8.5 | an authenticated user can execute arbitrary SQL commands due to improper access control (CWE-284) |
| CVE-2026-104317 | 8.1 | remote code execution via deserialization by an attacker who can reach the message broker (CWE-502) |
| CVE-2026-104316 | 6.5 | any authenticated user can cancel other users' background workflow jobs (CWE-285) |
| CVE-2026-104314 | 6.5 | users with read or share access to a flow can retrieve the owner's stored third-party credentials in plaintext via the API (CWE-522) |
| CVE-2026-77819 | 6.5 | authenticated arbitrary file overwrite due to a path restriction failure (CWE-22) |
| CVE-2026-104309 | 6.5 | authenticated sensitive information disclosure via path traversal (CWE-22) |
| CVE-2026-104331 | 5.4 | SSRF allowing unauthorized requests from the system (CWE-918) |
| CVE-2026-102590 | 5.0 | SSRF leading to sensitive information disclosure (CWE-918) |
| CVE-2026-104310 | 4.3 | SSRF leading to sensitive information disclosure (CWE-918) |
| CVE-2026-104315 | 4.3 | SSRF allowing unauthorized requests from the server, potentially enabling network enumeration (CWE-918) |
| CVE-2026-104308 | 4.3 | authenticated denial of service via OS command injection (CWE-78) |
| CVE-2026-104312 | 3.5 | a server-generated ZIP can contain path-traversal entries (CWE-22) |

IBM lists no workaround for bulletin one and asks for a backup and a release-notes review before the upgrade.

**Bulletin two (IBM node 7293016, published 2026-10-19): Langflow OSS 1.0.0 through 1.12.4, fixed 1.12.5.**

| CVE | IBM CVSS 3.1 | IBM's one-line description |
|---|---|---|
| CVE-2026-107328 | 9.9 | improper neutralization of code in eval/exec allows arbitrary code execution |
| CVE-2026-107329 | 9.9 | improper control of code generation allows arbitrary code execution |
| CVE-2026-107327 | 9.9 | missing authorization allows arbitrary code execution |
| CVE-2026-107326 | 8.8 | OS command injection allows arbitrary code execution |
| CVE-2026-110309 | 8.8 | improper control of code generation allows arbitrary command execution |
| CVE-2026-110196 | 8.8 | a low-privileged user can bypass the admin-only restriction and execute code via a built-in code-execution component |
| CVE-2026-107366 | 8.3 | message endpoints lack ownership checks: authenticated users can delete, overwrite or hijack others' messages and sessions (fixed in 1.9.0 per the bulletin) |
| CVE-2026-110245 | 7.5 | improper authentication lets a remote attacker obtain sensitive information without credentials |
| CVE-2026-90991 | 6.5 | unbounded resource allocation, authenticated denial of service |
| CVE-2026-110190 | 6.5 | directory traversal lets an authenticated user view arbitrary files |
| CVE-2026-110244 | 6.5 | a path restriction flaw lets an authenticated attacker obtain sensitive information |
| CVE-2026-110200 | 6.5 | sensitive information stored in cleartext |
| CVE-2026-77817 | 6.5 | secrets are not properly sanitized during flow and project exports (fixed in 1.11.5 per the bulletin) |
| CVE-2026-18894 | 6.5 | stored Python component code in public workflows runs under the flow owner's context on the server (fixed in 1.11.2 per the bulletin) |

Bulletin two names two mitigations for MCP stdio deployments that "do not replace the upgrade": set `LANGFLOW_MCP_SERVER_INTERPRETER_HARDENING=true` and `LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY=true` and restart. It also says to rotate any credentials that appear in previously exported files, because upgrading does not remove secrets already exported.

**The releases.** `langflow` 1.12.4 reached PyPI on 2026-09-29 at 20:13 UTC and 1.12.5 on 2026-10-06 at 20:08 UTC, twenty and thirteen days before the bulletins. Neither release page names a CVE. 1.12.4's notes carry "fix(auth): replace Passlib with bcrypt on release-1.12.4", "fix(mcp): reject direct Node runtime options in stdio configs", "fix(ssrf): pin direct Requests helper connections", "fix: block known pickle deserializers in generated components", "fix: hide stored flow credentials from shared readers" and "fix(security): protect Bing Search URL from run tweaks". 1.12.5's notes carry "fix(security): restrict built-in code execution to administrators", "fix(security): confine stored chat attachments to authorized storage", "fix(a2a): enforce authenticated execution policy", "fix(mcp): redact server credentials from management responses" and "fix(deps): upgrade vulnerable dependencies for 1.12.5". This file does not pair release-note lines with CVE ids, because neither IBM nor the release does.

**Where this sits among the Langflow files here.** The September bulletin (eleven CVEs, bulletin 2026-09-08, fixed 1.11.6, PyPI 2026-09-01) and these two (fixed 1.12.4 and 1.12.5) are followed by the 2026-10-28 bulletin (seven CVEs, fixed 1.13.0, PyPI 2026-10-22), so a reader on 1.12.5 is still one bulletin behind. None of the thirty ids is in CISA's KEV catalog as of its 2026-10-30 release; the catalog's six Langflow entries are CVE-2025-3248, CVE-2025-34291, CVE-2026-33017, CVE-2026-55255, CVE-2026-0770 and CVE-2026-9198. Langflow's own security tab, read on 2026-10-30, had no entry for any of these ids.

**Severity.** `critical` on IBM's 9.8 for an unauthenticated OS command injection and three 9.9s; `patched` rests on the vendor's bulletins and the two releases, with The Hacker News as the second source for the count and the fix versions.

## Am I affected?

```bash
pip show langflow 2>/dev/null | grep -i ^version        # below 1.12.4: all thirty; 1.12.4: the fourteen of bulletin two; below 1.13.0: the 2026-10-28 bulletin's seven
docker image ls | grep langflowai/langflow
grep -rn 'LANGFLOW_MCP_SERVER_INTERPRETER_HARDENING\|LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY' .env docker-compose*.yml 2>/dev/null
```

- Any instance below 1.12.4 that an untrusted network can reach is affected by CVE-2026-104339 (unauthenticated RCE). Any instance below 1.12.5 so reachable is affected by CVE-2026-110245 (unauthenticated information disclosure).
- Any instance below 1.12.5 with accounts you do not fully trust is affected by the authenticated code-execution records, the credential reads and the export leak.
- Any instance that ever exported flows or projects on an affected release has secrets in those exports that the upgrade does not remove.

## If you are affected

1. Back up the database, the secret key and uploaded files, then upgrade to 1.13.0 (`pip install --upgrade "langflow==1.13.0"` or the `langflowai/langflow:1.13.0` image), following the auto-login recovery steps in [the 1.13.0 file](2026-10-langflow-1-13-0-ibm-bulletin-seven-cves-auth-bypass-code-generation-rce.md). 1.12.4 and 1.12.5 close these thirty but leave the 10-28 bulletin's seven open.
2. Set `LANGFLOW_MCP_SERVER_INTERPRETER_HARDENING=true` and `LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY=true` where MCP stdio servers are configured, and restart.
3. Rotate every credential stored in the instance or present in any exported flow or project file: [rotating cloud credentials](../playbooks/rotating-cloud-credentials.md), [if your web app was compromised](../playbooks/if-your-webapp-was-compromised.md). An unauthenticated instance that was reachable before 1.12.4 should be treated as compromised.

## Prevention

- Keep Langflow off the public internet and behind your own authentication, and treat every code-executing component as a shell for whoever can reach it: [agent sandboxing](../prevention/agent-sandboxing.md).
- Fewer long-lived provider keys inside the flow builder, and no exports with secrets in them: [credential hygiene](../prevention/credential-hygiene.md).

## Sources
- [IBM Security Bulletin — Langflow OSS is affected by multiple vulnerabilities (node 7293015)](https://www.ibm.com/support/pages/node/7293015) — fetched 2026-11-02: published 2026-10-19, the sixteen CVEs with IBM CVSS scores and descriptions quoted above, affected 1.0.0 through 1.12.3, remediation 1.12.4, no workaround.
- [IBM Security Bulletin — Langflow OSS is affected by multiple vulnerabilities (node 7293016)](https://www.ibm.com/support/pages/node/7293016) — fetched 2026-11-02: published 2026-10-19, the fourteen CVEs with scores and descriptions, affected 1.0.0 through 1.12.4, remediation 1.12.5, the two MCP hardening variables, the export-credential rotation note, the earlier fix versions for CVE-2026-107366, CVE-2026-18894 and CVE-2026-77817.
- [CVE Services — CVE-2026-104339](https://cveawg.mitre.org/api/cve/CVE-2026-104339) — fetched 2026-11-02: CNA ibm, published 2026-10-29 15:16 UTC, affected 1.0.0 through 1.12.3, CVSS 9.8 `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`, the description quoted above, node 7293015 as the only reference.
- [GitHub Advisory Database — GHSA-8rq9-23x9-43h7](https://github.com/advisories/GHSA-8rq9-23x9-43h7) — fetched 2026-11-02: CVE-2026-104339, 9.8, published 2026-10-29, unreviewed, affected and patched versions "Unknown". [The `langflow` query](https://github.com/advisories?query=langflow+sort%3Apublished-desc), page 1, same day: 25 rows, all 2026-10-29, carrying 21 of the thirty ids and the four 10-28 bulletin ids.
- [The Hacker News — Critical Langflow Flaws Could Let Unauthenticated Attackers Run Code on Servers](https://thehackernews.com/2026/11/critical-langflow-flaws-could-let.html) — fetched 2026-11-02: 2026-11-02, Swati Khandelwal; "29 other" Langflow records published 2026-10-29 with 1.12.4 and 1.12.5 as fixes, CVE-2026-104339 as a 9.8 unauthenticated code-execution record among them, none of IBM's 33 records listing 1.13.0 as affected, the upgrade steps.
- [langflow-ai/langflow — release v1.12.4](https://github.com/langflow-ai/langflow/releases/tag/v1.12.4) and [release v1.12.5](https://github.com/langflow-ai/langflow/releases/tag/v1.12.5) — fetched 2026-11-02: dated 29 Sep and 06 Oct (no year shown), the fix lines quoted above, no CVE named.
- PyPI `langflow` release metadata, queried 2026-11-02: 1.11.6 2026-09-01, 1.12.3 2026-09-22, 1.12.4 2026-09-29 20:13 UTC, 1.12.5 2026-10-06 20:08 UTC, 1.12.8 2026-10-22 17:08 UTC, 1.13.0 2026-10-22 21:20 UTC; newest 1.13.0.
- [CISA KEV JSON feed](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json) — fetched 2026-11-02: catalog release 2026-10-30, six Langflow entries, none of the thirty ids.
- Related in this corpus: [Langflow 1.13.0 (IBM bulletin of 2026-10-28, seven CVEs)](2026-10-langflow-1-13-0-ibm-bulletin-seven-cves-auth-bypass-code-generation-rce.md), [Langflow IBM PSIRT eleven-CVE batch (fixed 1.11.6)](2026-09-langflow-ibm-psirt-eleven-cve-batch.md), [Langflow fernet key, webhook bypass and Python REPL wave](2026-10-langflow-fernet-key-webhook-bypass-python-repl-cve-wave.md).