{"id":"CVE-2026-107326","kind":"vulnerability","aliases":["CVE-2026-107326"],"related":[],"title":"Langflow: authenticated users can run OS commands on the server","description":"IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.","summary":"IBM Langflow OSS versions 1.0.0 through 1.12.4 fail to neutralize special characters passed to an operating system command. A logged-in remote attacker can use this to execute arbitrary code on the host.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","langflow","python","self-hosted"],"not_affected_if":["no-authenticated-users","versions-outside-range"],"how_to_check":"- Check the installed Langflow version (for example `pip show langflow`) and see whether it falls within `1.0.0` through `1.12.4`.","fix":"- Langflow OSS: move to a version later than `1.12.4` (the sources do not name the exact fixed release).","status":"open","published_at":"2026-10-29T16:17:50+00:00","first_seen_at":"2026-10-29T16:25:55+00:00","triaged_at":"2026-10-29T16:29:17+00:00","updated_at":"2026-10-29T16:29:17+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-29T16:29:17Z","model":"claude-haiku-5-5","output":{"fix":"- Langflow OSS: move to a version later than `1.12.4` (the sources do not name the exact fixed release).","reach":"network","title":"Langflow: authenticated users can run OS commands on the server","impact":"high","summary":"IBM Langflow OSS versions 1.0.0 through 1.12.4 fail to neutralize special characters passed to an operating system command. A logged-in remote attacker can use this to execute arbitrary code on the host.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["langflow","self-hosted","python"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Authenticated attacker runs arbitrary code on the Langflow server.","analyst_note":"Find the vulnerable endpoint and the fixed Langflow version from the IBM advisory or the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-107326.","how_to_check":"- Check the installed Langflow version (for example `pip show langflow`) and see whether it falls within `1.0.0` through `1.12.4`.\n- unknown for other checks: the sources do not say which feature or endpoint is involved.","plain_action":"","needs_analyst":true,"not_affected_if":["versions-outside-range","no-authenticated-users"],"who_is_affected":"Teams running IBM Langflow OSS from 1.0.0 through 1.12.4, typically self-hosted instances where users can log in. The sources do not say which feature triggers the command injection, so the exact exposed path is unknown. Teams on versions outside that range are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00071,"input_tokens":4103,"output_tokens":599,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-107326':13A,16A '-2026':12A,15A '1.0.0':29B,62C '1.12.4':31B,64C 'ai':18B 'ai-tool':17B 'allow':66C 'arbitrari':54B,73C 'attack':48B,70C 'authent':2A,69C 'charact':36B 'code':55B,74C 'command':7A,42B,86C 'could':65C 'cve':11A,14A 'due':75C 'element':81C 'execut':53B,72C 'fail':32B 'host':24B,58B 'ibm':25B,59C 'improp':77C 'langflow':1A,20B,26B,60C 'log':45B 'logged-in':44B 'neutral':34B,78C 'oper':40B 'os':6A,85C 'oss':27B,61C 'pass':37B 'python':21B 'remot':47B,68C 'run':5A 'self':23B 'self-host':22B 'server':10A 'special':35B,80C 'system':41B 'tool':19B 'use':50B,82C 'user':3A 'version':28B","nicknames":[],"mitigations":[],"who_affected":"Teams running IBM Langflow OSS from 1.0.0 through 1.12.4, typically self-hosted instances where users can log in. The sources do not say which feature triggers the command injection, so the exact exposed path is unknown. Teams on versions outside that range are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"first_public_at":"2026-10-29T16:17:50+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107326","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107326","severity":null,"published_at":"2026-10-29T16:17:50+00:00","modified_at":"2026-10-29T16:17:50+00:00","first_seen_at":"2026-10-29T16:25:55+00:00","fetched_at":"2026-10-29T16:25:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}