CVE-2026-104334criticalCode execution2026-10-07

CVE-2026-104334 and CVE-2026-93674: IBM's Langflow OSS bulletin lists two unauthenticated code execution flaws plus a batch of sandbox, file access and credential issues, fixed in 1.12.3

IBM security bulletin 7290694 (first published 2 October 2026, CVE records on NVD from 7 October) covers Langflow OSS 1.0.0 through 1.12.2. Two of its CVEs are rated 9.8 and need no login: CVE-2026-104334 (code injection) and CVE-2026-93674 (OS command injection), both of which IBM says could let a remote attacker execute arbitrary code. The same bulletin lists several authenticated code execution and sandbox escape bugs, a path traversal that writes and reads files, access control gaps in vertex result caching, credential exposure and a ZIP extraction denial of service. IBM's fix is to upgrade to Langflow OSS 1.12.3.

01.

What it is

CVE-2026-104334 (CWE-94, CVSS 9.8, no authentication): IBM describes it as improper control of code generation that could allow a remote attacker to execute arbitrary code.

CVE-2026-93674 (CVSS 9.8, no authentication): improper neutralization of special elements used in an OS command, which could allow a remote attacker to execute arbitrary code.

Authenticated code execution in the same bulletin (CVSS 8.8 each): CVE-2026-97676 (sandbox escape through code injection), CVE-2026-97678 and CVE-2026-97673 (protection mechanism failure), CVE-2026-97655 (incomplete blocklist in the code security scanner) and CVE-2026-97679 (OS command injection).

Other issues: CVE-2026-97677 (CVSS 8.1, a flow author can write files into any directory the service account can write and, through a crafted on-disk index, read files such as configuration, secrets or the database), CVE-2026-97680 (CVSS 8.3, access control gap in vertex result caching), CVE-2026-101329 (CVSS 6.5, information disclosure through improper access control), CVE-2026-101331 (CVSS 7.7, insufficiently protected credentials) and CVE-2026-93679 (denial of service through ZIP extraction).

IBM gives no technical write-up beyond these descriptions and lists no workarounds.

02.

How to check

Affected: Langflow OSS 1.0.0 through 1.12.2, per IBM's bulletin.
You are most exposed if a Langflow server is reachable from the internet or by people you don't fully trust, since the two 9.8 issues need no login.

03.

How to fix

Upgrade Langflow to 1.12.3 or later and restart it.
Until then, keep Langflow off the public internet and behind authentication and a network boundary only trusted users can reach.
Treat API keys and credentials stored in flows or the Langflow database as possibly exposed if the server was publicly reachable, and rotate them.

pip show langflow | grep -i version
pip install -U 'langflow>=1.12.3'

04.

Sources

More advisories for this tool