Live › vulnerability › CVE-2026-107327
IBM Langflow OSS versions 1.0.0 through 1.12.4 lack an authorization check in one path. A logged-in attacker can use it to execute arbitrary code on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
Teams running self-hosted IBM Langflow OSS in the affected range are exposed. An attacker needs a valid account on the instance, and the sources do not say whether default configuration is affected. unknown whether managed or hosted Langflow services are involved.
No product ranges from the sources yet.
pip show langflow, and compare it to the affected range 1.0.0 through 1.12.4.1.12.4; the exact fixed version is unknown from the sources.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to missing authorization.
This page as .md · .json · in your agent: get_signal("CVE-2026-107327")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.