Live › vulnerability › CVE-2026-104324
IBM Langflow OSS versions 1.0.0 through 1.12.3 deserialize untrusted data without checks. A remote attacker with a valid account can use this to execute arbitrary code on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
Teams running self-hosted Langflow OSS between 1.0.0 and 1.12.3 where users can log in. The sources do not say whether managed or hosted Langflow instances are affected. Instances without user accounts or not exposed beyond a trusted network are less exposed.
No product ranges from the sources yet.
pip show langflow or langflow --version; versions 1.0.0 through 1.12.3 are affected.1.12.3; the sources do not name the exact fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to deserialization of untrusted data.
This page as .md · .json · in your agent: get_signal("CVE-2026-104324")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.