CVE-2026-104339criticalCode execution2026-10-29

CVE-2026-104339 and 30 more: IBM's Langflow 1.12.4 and 1.12.5 bulletins fix unauthenticated RCE, three 9.9 code execution bugs, SSRF and path traversal

Two IBM security bulletins from 19 October 2026 (7293015 and 7293016), with CVE records added to NVD on 29 October, cover more than 30 Langflow OSS flaws. The worst is CVE-2026-104339, an unauthenticated OS command injection that leads to code execution in 1.0.0 through 1.12.3, plus three 9.9 code execution bugs any logged-in user can reach in versions up to 1.12.4. Upgrade straight to 1.13.0, which also covers the newer bulletin 7294467.

01.

What it is

CVE-2026-104339 (9.8): a remote attacker can run arbitrary code because of improper neutralization of special elements in an OS command. Fixed in 1.12.4.

CVE-2026-107327 (9.9, missing authorization), CVE-2026-107328 (9.9, eval and exec injection) and CVE-2026-107329 (9.9, code generation): an authenticated user can run code on the server. Fixed in 1.12.5.

CVE-2026-110196 (8.8): a low-privileged user can get past the administrator-only restriction and run code by configuring a built-in code-execution component. CVE-2026-107326, CVE-2026-110309, CVE-2026-104324 (deserialization), CVE-2026-104328 and CVE-2026-101288 are further 8.8 issues, and CVE-2026-104317 (8.1) is deserialization in the message broker path.

CVE-2026-103092 (8.5) is SQL injection, CVE-2026-107366 (8.3) is message endpoints with no ownership check, and CVE-2026-110245 (7.5) is unauthenticated information disclosure.

Also fixed: SSRF (CVE-2026-104310, CVE-2026-102590, CVE-2026-104315, CVE-2026-104331), path traversal and file overwrite (CVE-2026-110190, CVE-2026-110244, CVE-2026-77819, CVE-2026-104309, CVE-2026-104312), credentials shown to users with only read or share access (CVE-2026-104314), cancelling another user's job (CVE-2026-104316), secrets left in exported flows (CVE-2026-77817), cleartext storage (CVE-2026-110200) and denial of service (CVE-2026-90991, CVE-2026-104308).

02.

How to check

Run pip show langflow. Versions 1.0.0 to 1.12.3 have every issue here; 1.12.4 still has the 1.12.5 set.
Check whether low-privileged or shared accounts exist on your instance, since many of these need only a normal login.
If you exported flows, check the exported JSON files for API keys or other secrets.

03.

How to fix

Upgrade to Langflow 1.13.0, the current fixed release that also closes bulletin 7294467.
If you can't upgrade yet and use MCP stdio, IBM's workaround is to set LANGFLOW_MCP_SERVER_INTERPRETER_HARDENING=true and LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY=true, then restart.
Rotate any secrets that appeared in exported flow files.

pip install --upgrade "langflow==1.13.0"

# temporary hardening for MCP stdio setups until you upgrade
export LANGFLOW_MCP_SERVER_INTERPRETER_HARDENING=true
export LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY=true

04.

Sources

More advisories for this tool