IBM discloses 14 Langflow CVEs, including three authenticated code-execution flaws rated 9.9, fixed in Langflow 1.12.5

Vulnerability · Langflow · CRITICAL

Incident dateNot stated

DisclosedOct 19, 2026 (IBM Security Bulletin 7293016). NVD published CVE-2026-107366 on Oct 20, 2026; the other 13 CVEs had no public record as of the morning of Oct 20. Fixed release 1.12.5 came out Oct 6, 2026; IBM says three of the fixes shipped earlier (1.9.0, 1.11.2, 1.11.5).

Added hereOct 20, 8:32 AM ET

Last verifiedOct 20, 2026

Summary

IBM published Security Bulletin 7293016 on Oct 19, 2026, disclosing 14 CVEs in Langflow OSS, the open-source tool for building AI agents and workflows. IBM says versions 1.0.0 through 1.12.4 are affected and recommends upgrading to 1.12.5, which was released on Oct 6, 2026. Three of the flaws, CVE-2026-107327, CVE-2026-107328 and CVE-2026-107329, let a remote attacker who has an account run arbitrary code, and IBM scores each of them CVSS 3.1 9.9. Three more code or command execution flaws, CVE-2026-107326, CVE-2026-110196 and CVE-2026-110309, are scored 8.8. IBM says CVE-2026-110196 lets a low-privileged user get around the admin-only restriction on a built-in code-execution component. CVE-2026-107366 (8.3) lets any logged-in user delete or overwrite other users' messages, including to inject prompts, or take over a conversation session. Two need no login: CVE-2026-110245 (7.5), an information disclosure caused by improper authentication, and CVE-2026-18894 (6.5), which lets a remote caller trigger stored Python component code in a public workflow under the flow owner's context. The other five are scored 6.5: a denial of service, two path traversal bugs, cleartext storage of sensitive information, and secrets left in flow and project exports. As of the morning of Oct 20, 2026, only CVE-2026-107366 had a record in NVD. The other 13 IDs had no public CVE record yet, so IBM's bulletin is the only detailed source for them. We found no reports that any of these CVEs are being exploited.

Severity

CRITICAL Critical (VibeIncidents editorial rating, following IBM's CVSS 3.1 9.9 for three code-execution CVEs: network attack, low privileges, no user interaction, scope changed). Most of the flaws need an account, but on a shared or internet-facing Langflow instance any account could be enough to run code on the server, and two of the 14 need no login at all. Fixes have been available since Oct 6, 2026. We found no exploitation reports, and 13 of the 14 CVEs had no public CVE record when we published.

Timeline

Apr 14, 2026
Langflow 1.9.0 is released. IBM's bulletin says it fixed CVE-2026-107366.
Aug 4, 2026
Langflow 1.11.2 is released. IBM says it fixed CVE-2026-18894.
Aug 25, 2026
Langflow 1.11.5 is released. IBM says it fixed CVE-2026-77817, the secrets left in flow and project exports.
Sep 29, 2026
Langflow 1.12.4, the last affected version per IBM, is released.
Oct 6, 2026
Langflow 1.12.5 is released on PyPI and GitHub. Its release notes list security fixes such as restricting built-in code execution to administrators and enforcing an authenticated execution policy for agent-to-agent (A2A) requests.
Oct 13, 2026
Langflow 1.12.6 is released. It is the current version as of Oct 20, 2026.
Oct 19, 2026
IBM publishes Security Bulletin 7293016 listing the 14 CVEs, their CVSS scores and the fixed version.
Oct 20, 2026, 00:17 UTC
NVD publishes CVE-2026-107366, with IBM as the source. The other 13 IDs have no public CVE record as of the morning of Oct 20.

How it happened

IBM's bulletin gives a one-line description for each CVE and does not name the affected endpoints or components for most of them. Its summary says that, depending on the feature and how Langflow is deployed, an authenticated attacker could bypass component security scanning, inject callback arguments, execute arbitrary class definitions, or execute commands through the agent communication endpoint. It does not say which CVE matches which of those paths. Per IBM, CVE-2026-107328 and CVE-2026-107329 are code injection flaws (CWE-94), one through eval/exec, and CVE-2026-107327 is a missing authorization check (CWE-862), all three scored 9.9 with a changed scope. CVE-2026-107326 is OS command injection (CWE-78). CVE-2026-110196 lets a low-privileged account bypass the administrator-only restriction by configuring a built-in code-execution component with its own inputs. CVE-2026-107366 is the one with a fuller description: three message endpoints did not check who owned a message, so any logged-in user could bulk-delete another user's messages, overwrite their content, or reassign a session ID to hijack a whole conversation. CVE-2026-18894 lets a remote caller run stored Python component code that already exists in a public workflow, which IBM says bypasses the rule that public execution paths only run server-trusted component code. CVE-2026-77817 left secrets in flow and project exports. IBM notes that upgrading stops this in new exports but does not remove secrets from files already exported. Beyond upgrading, IBM asks deployments that use MCP over stdio to set LANGFLOW_MCP_SERVER_INTERPRETER_HARDENING=true, which rejects direct shell-script execution, and LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY=true, which blocks non-admin MCP stdio access. It warns these settings can require changes to existing MCP server launch configurations. This bulletin is a separate batch from the earlier Langflow MCP stdio advisories, CVE-2026-105740 and CVE-2026-105697, which were fixed in 1.10.3.

How to check your app

Check your Langflow version (pip show langflow, or the version shown in the UI). If it is 1.12.4 or older, upgrade to 1.12.5 or later; 1.12.6 is current. IBM says to back up your installation first and follow its upgrade instructions.
If you use MCP servers over stdio, set LANGFLOW_MCP_SERVER_INTERPRETER_HARDENING=true and LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY=true and restart Langflow, as IBM recommends. Test your MCP server launch configurations afterwards, since IBM says they may need changes.
For public workflows, keep the default restriction on custom components and don't set LANGFLOW_ALLOW_PUBLIC_CUSTOM_COMPONENTS, which IBM says removes the protection described for CVE-2026-18894.
If you exported flows or projects with an older version, revoke or rotate any credentials those files contain. IBM says upgrading does not remove secrets from copies already exported.
Until you have upgraded, treat every account on a shared instance as able to run code on the server. Remove accounts you don't need, keep the instance off the open internet, and turn off LANGFLOW_AUTO_LOGIN. Langflow's earlier advisory GHSA-7w94-79vh-5mr2 notes that with auto-login on, an exposed instance hands out a session token without credentials.

Related on VibeIncidents

Langflow's MCP server settings let any logged-in user run commands on the server (CVE-2026-105740, CVE-2026-105697)

Sources

Corrections and updates

None. Re-checked against every source on Oct 20, 2026.

Cite this entry

Title: IBM discloses 14 Langflow CVEs, including three authenticated code-execution flaws rated 9.9, fixed in Langflow 1.12.5
Added: Oct 20, 2026
URL: https://vibeincidents.com/incidents/langflow-ibm-bulletin-14-cves-2026-10/
Suggested citation: VibeIncidents. "IBM discloses 14 Langflow CVEs, including three authenticated code-execution flaws rated 9.9, fixed in Langflow 1.12.5." Oct 20, 2026. https://vibeincidents.com/incidents/langflow-ibm-bulletin-14-cves-2026-10/