{"id":"CVE-2026-104324","kind":"vulnerability","aliases":["CVE-2026-104324"],"related":[],"title":"Langflow: untrusted data deserialization lets an authenticated user run code","description":"IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to deserialization of untrusted data.","summary":"IBM Langflow OSS versions 1.0.0 through 1.12.3 deserialize untrusted data without checks. A remote attacker with a valid account can use this to execute arbitrary code on the server.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","langflow","python","self-hosted"],"not_affected_if":["no-remote-login","versions-outside-range"],"how_to_check":"- Check the installed version with `pip show langflow` or `langflow --version`; versions 1.0.0 through 1.12.3 are affected.\n- Confirm whether the instance is reachable from the internet or only from a trusted network.","fix":"- Move to a Langflow OSS release newer than `1.12.3`; the sources do not name the exact fixed version.","status":"open","published_at":"2026-10-29T16:17:44+00:00","first_seen_at":"2026-10-29T16:25:54+00:00","triaged_at":"2026-10-29T16:29:17+00:00","updated_at":"2026-10-29T16:29:17+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-10-29T16:29:17Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a Langflow OSS release newer than `1.12.3`; the sources do not name the exact fixed version.","reach":"internet","title":"Langflow: untrusted data deserialization lets an authenticated user run code","impact":"high","summary":"IBM Langflow OSS versions 1.0.0 through 1.12.3 deserialize untrusted data without checks. A remote attacker with a valid account can use this to execute arbitrary code on the server.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["langflow","self-hosted","python"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"Code runs on the Langflow server as an authenticated user.","analyst_note":"Confirm the fixed version and any workaround from the IBM advisory linked from NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-104324).","how_to_check":"- Check the installed version with `pip show langflow` or `langflow --version`; versions 1.0.0 through 1.12.3 are affected.\n- Confirm whether the instance is reachable from the internet or only from a trusted network.","plain_action":"","needs_analyst":true,"not_affected_if":["versions-outside-range","no-remote-login"],"who_is_affected":"Teams running self-hosted Langflow OSS between 1.0.0 and 1.12.3 where users can log in. The sources do not say whether managed or hosted Langflow instances are affected. Instances without user accounts or not exposed beyond a trusted network are less exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000702,"input_tokens":4097,"output_tokens":585,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-104324':13A,16A '-2026':12A,15A '1.0.0':29B,57C '1.12.3':31B,59C 'account':43B 'ai':18B 'ai-tool':17B 'allow':61C 'arbitrari':49B,68C 'attack':39B,65C 'authent':7A,64C 'check':36B 'code':10A,50B,69C 'could':60C 'cve':11A,14A 'data':3A,34B,75C 'deseri':4A,32B,72C 'due':70C 'execut':48B,67C 'host':24B 'ibm':25B,54C 'langflow':1A,20B,26B,55C 'let':5A 'oss':27B,56C 'python':21B 'remot':38B,63C 'run':9A 'self':23B 'self-host':22B 'server':53B 'tool':19B 'untrust':2A,33B,74C 'use':45B 'user':8A 'valid':42B 'version':28B 'without':35B","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted Langflow OSS between 1.0.0 and 1.12.3 where users can log in. The sources do not say whether managed or hosted Langflow instances are affected. Instances without user accounts or not exposed beyond a trusted network are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:17:44+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-104324","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104324","severity":null,"published_at":"2026-10-29T16:17:44+00:00","modified_at":"2026-10-29T16:17:44+00:00","first_seen_at":"2026-10-29T16:25:54+00:00","fetched_at":"2026-10-29T16:25:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}