{"id":"CVE-2026-103092","kind":"vulnerability","aliases":["CVE-2026-103092"],"related":[],"title":"Langflow: authenticated users can run arbitrary SQL commands remotely","description":"IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper access control.","summary":"IBM Langflow OSS versions 1.0.0 through 1.12.3 have an improper access control flaw. A remote attacker with a valid account can execute arbitrary SQL commands against the database.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","langflow","python","self-hosted"],"not_affected_if":["managed-hosting","no-remote-accounts"],"how_to_check":"- Check the installed Langflow version with `langflow --version` or the package version in your environment.\n- Confirm whether Langflow is reachable from networks where users other than trusted staff can log in.","fix":"- Move to a Langflow OSS release above `1.12.3`; the exact fixed version is unknown from the sources.","status":"open","published_at":"2026-10-29T16:17:41+00:00","first_seen_at":"2026-10-29T16:25:54+00:00","triaged_at":"2026-10-29T16:29:30+00:00","updated_at":"2026-10-29T16:29:30+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-29T16:29:30Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a Langflow OSS release above `1.12.3`; the exact fixed version is unknown from the sources.","reach":"internet","title":"Langflow: authenticated users can run arbitrary SQL commands remotely","impact":"high","summary":"IBM Langflow OSS versions 1.0.0 through 1.12.3 have an improper access control flaw. A remote attacker with a valid account can execute arbitrary SQL commands against the database.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["langflow","self-hosted","python"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker reads or changes the Langflow database with arbitrary SQL.","analyst_note":"Confirm the fixed version and whether the flaw is reachable by default; check https://nvd.nist.gov/vuln/detail/CVE-2026-103092 and IBM's advisory.","how_to_check":"- Check the installed Langflow version with `langflow --version` or the package version in your environment.\n- Confirm whether Langflow is reachable from networks where users other than trusted staff can log in.","plain_action":"","needs_analyst":true,"not_affected_if":["managed-hosting","no-remote-accounts"],"who_is_affected":"Teams running self-hosted Langflow OSS between 1.0.0 and 1.12.3 where users have accounts. The sources do not say whether managed or hosted Langflow deployments are affected. Installs without remote user access are lower risk.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000694,"input_tokens":4097,"output_tokens":569,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-103092':12A,15A '-2026':11A,14A '1.0.0':28B,55C '1.12.3':30B,57C 'access':34B,72C 'account':43B 'ai':17B 'ai-tool':16B 'allow':59C 'arbitrari':6A,46B,66C 'attack':39B,63C 'authent':2A,62C 'command':8A,48B,68C 'control':35B,73C 'could':58C 'cve':10A,13A 'databas':51B 'due':69C 'execut':45B,65C 'flaw':36B 'host':23B 'ibm':24B,52C 'improp':33B,71C 'langflow':1A,19B,25B,53C 'oss':26B,54C 'python':20B 'remot':9A,38B,61C 'run':5A 'self':22B 'self-host':21B 'sql':7A,47B,67C 'tool':18B 'user':3A 'valid':42B 'version':27B","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted Langflow OSS between 1.0.0 and 1.12.3 where users have accounts. The sources do not say whether managed or hosted Langflow deployments are affected. Installs without remote user access are lower risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:17:41+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-103092","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103092","severity":null,"published_at":"2026-10-29T16:17:41+00:00","modified_at":"2026-10-29T16:17:41+00:00","first_seen_at":"2026-10-29T16:25:54+00:00","fetched_at":"2026-10-29T16:25:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}