Live › vulnerability › CVE-2026-103092
IBM Langflow OSS versions 1.0.0 through 1.12.3 have an improper access control flaw. A remote attacker with a valid account can execute arbitrary SQL commands against the database.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
Teams running self-hosted Langflow OSS between 1.0.0 and 1.12.3 where users have accounts. The sources do not say whether managed or hosted Langflow deployments are affected. Installs without remote user access are lower risk.
No product ranges from the sources yet.
langflow --version or the package version in your environment.1.12.3; the exact fixed version is unknown from the sources.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper access control.
This page as .md · .json · in your agent: get_signal("CVE-2026-103092")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.