---
id: "CVE-2026-104317"
kind: "vulnerability"
aliases: ["CVE-2026-104317"]
title: "Langflow: message broker deserialization lets remote attacker run code"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "langflow", "fixed": ["1.12.4"], "affected": ">= 1.0.0, <= 1.12.3", "ecosystem": "pypi"}]
ecosystems: []
tags: ["ai-tooling", "langflow", "message-broker", "self-hosted"]
not_affected_if: ["broker-not-reachable", "managed-hosting"]
published_at: "2026-10-29T16:17:43+00:00"
first_seen_at: "2026-10-29T16:25:54+00:00"
updated_at: "2026-10-29T16:30:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104317", "first_seen_at": "2026-10-29T16:25:54+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-29T16:30:30+00:00"}]
---

# Langflow: message broker deserialization lets remote attacker run code

IBM Langflow OSS versions 1.0.0 through 1.12.3 deserialize untrusted data arriving through the message broker. An attacker who can reach that broker can execute arbitrary code on the host.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:langflow affected >= 1.0.0, <= 1.12.3 fixed 1.12.4

## How to check

- Check the installed Langflow version with `langflow --version` or `pip show langflow`, and treat `1.0.0` through `1.12.3` as affected.
- Check whether the message broker used by the Langflow deployment is reachable from untrusted networks.

## Fix

Upgrade Langflow OSS to 1.12.4 or later (IBM). A later IBM bulletin (28 Oct 2026) covers other flaws through 1.12.8 and recommends 1.13.0 or later, so move to 1.13.0+. Pip: pip install langflow --upgrade. Docker: pull the latest tagged image. IBM lists no workarounds.

## Timeline

- 2026-10-29T16:25:54+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-104317
- 2026-10-29T16:30:30+00:00 analyst — IBM bulletin (19 Oct 2026) lists CVE-2026-104317, affected 1.0.0-1.12.3, fix 1.12.4, no workarounds. Bulletin does not state default broker exposure. A later IBM bulletin (28 Oct) covers other CVEs up to 1.12.8 and recommends 1.13.0, so 1.13.0+ covers both. No exploitation found in sources.

## Documents

- [advisory] IBM Security Bulletin: Langflow OSS is affected by multiple vulnerabilities (19 Oct 2026) https://www.ibm.com/support/pages/security-bulletin-langflow-oss-affected-multiple-vulnerabilities-0

## From the sources

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker who could reach the message broker to execute arbitrary code on the system due to the deserialization of untrusted data.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_