{"id":"CVE-2026-101288","kind":"vulnerability","aliases":["CVE-2026-101288"],"related":[],"title":"IBM Langflow OSS: authenticated users can run arbitrary code remotely","description":"IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in code.","summary":"IBM Langflow OSS versions 1.0.0 through 1.12.3 fail to neutralize special elements in code, which lets a remote attacker who has a valid account execute arbitrary code. The NVD rating is high, with a CVSS score of 8.8.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","langflow","python","self-hosted"],"not_affected_if":["version-outside-range"],"how_to_check":"- Check the installed Langflow version, for example with `pip show langflow`, and compare it to the affected range `1.0.0` through `1.12.3`.\n- Confirm whether the instance is reachable from the internet and who holds accounts on it.","fix":"- Move to a Langflow OSS release newer than `1.12.3`; the sources do not name the exact fixed version.","status":"open","published_at":"2026-10-29T16:17:35+00:00","first_seen_at":"2026-10-29T16:25:54+00:00","triaged_at":"2026-10-29T16:29:21+00:00","updated_at":"2026-10-29T16:29:21+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-29T16:29:21Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a Langflow OSS release newer than `1.12.3`; the sources do not name the exact fixed version.","reach":"network","title":"IBM Langflow OSS: authenticated users can run arbitrary code remotely","impact":"high","summary":"IBM Langflow OSS versions 1.0.0 through 1.12.3 fail to neutralize special elements in code, which lets a remote attacker who has a valid account execute arbitrary code. The NVD rating is high, with a CVSS score of 8.8.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["langflow","self-hosted","python"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker runs arbitrary code on the Langflow server","analyst_note":"Check the NVD entry and IBM's advisory for the fixed version and the exact vulnerable feature, since the sources give only the range and the description.","how_to_check":"- Check the installed Langflow version, for example with `pip show langflow`, and compare it to the affected range `1.0.0` through `1.12.3`.\n- Confirm whether the instance is reachable from the internet and who holds accounts on it.","plain_action":"","needs_analyst":true,"not_affected_if":["version-outside-range"],"who_is_affected":"Teams that run IBM Langflow OSS between 1.0.0 and 1.12.3 on a server where users log in. The sources do not say which features or configurations are required to reach the flaw, so the exposure of any given deployment is unknown. Installations on a newer version are not in the stated range.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000709,"input_tokens":4100,"output_tokens":597,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-101288':13A,16A '-2026':12A,15A '1.0.0':29B,66C '1.12.3':31B,68C '8.8':62B 'account':48B 'ai':18B 'ai-tool':17B 'allow':70C 'arbitrari':8A,50B,77C 'attack':43B,74C 'authent':4A,73C 'code':9A,38B,51B,78C,88C 'could':69C 'cve':11A,14A 'cvss':59B 'due':79C 'element':36B,85C 'execut':49B,76C 'fail':32B 'high':56B 'host':24B 'ibm':1A,25B,63C 'improp':81C 'langflow':2A,20B,26B,64C 'let':40B 'neutral':34B,82C 'nvd':53B 'oss':3A,27B,65C 'python':21B 'rate':54B 'remot':10A,42B,72C 'run':7A 'score':60B 'self':23B 'self-host':22B 'special':35B,84C 'tool':19B 'use':86C 'user':5A 'valid':47B 'version':28B","nicknames":[],"mitigations":[],"who_affected":"Teams that run IBM Langflow OSS between 1.0.0 and 1.12.3 on a server where users log in. The sources do not say which features or configurations are required to reach the flaw, so the exposure of any given deployment is unknown. Installations on a newer version are not in the stated range.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:17:35+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101288","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101288","severity":null,"published_at":"2026-10-29T16:17:35+00:00","modified_at":"2026-10-29T16:17:35+00:00","first_seen_at":"2026-10-29T16:25:54+00:00","fetched_at":"2026-10-29T16:25:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}