{"id":"CVE-2026-107329","kind":"vulnerability","aliases":["CVE-2026-107329"],"related":[],"title":"Langflow: authenticated users can run arbitrary code through code generation","description":"IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code generation.","summary":"IBM Langflow OSS versions 1.0.0 through 1.12.4 let a logged-in remote user run arbitrary code on the server because the code generation path does not properly control what it executes. An attacker who holds any valid account gets code execution on the host running Langflow.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-apps","ai-tooling","langflow","python","self-hosted"],"not_affected_if":["managed-hosting","no-untrusted-accounts","versions-outside-range"],"how_to_check":"- Check the installed Langflow version with `langflow --version` or `pip show langflow`.\n- Confirm whether any version in the range `1.0.0` to `1.12.4` is running, including Docker images.\n- Check whether the Langflow instance is reachable from the internet or from untrusted users.","fix":"- Move to a Langflow OSS version newer than `1.12.4`; the sources do not name the exact fixed release.","status":"open","published_at":"2026-10-29T16:17:50+00:00","first_seen_at":"2026-10-29T16:25:55+00:00","triaged_at":"2026-10-29T16:27:12+00:00","updated_at":"2026-10-29T16:27:12+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-29T16:27:12Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a Langflow OSS version newer than `1.12.4`; the sources do not name the exact fixed release.","reach":"internet","title":"Langflow: authenticated users can run arbitrary code through code generation","impact":"high","summary":"IBM Langflow OSS versions 1.0.0 through 1.12.4 let a logged-in remote user run arbitrary code on the server because the code generation path does not properly control what it executes. An attacker who holds any valid account gets code execution on the host running Langflow.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["langflow","self-hosted","python","ai-apps"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker runs arbitrary code on the Langflow server","analyst_note":"Find the IBM advisory and the fixed Langflow version, and confirm whether the exposure needs a specific flow or feature enabled.","how_to_check":"- Check the installed Langflow version with `langflow --version` or `pip show langflow`.\n- Confirm whether any version in the range `1.0.0` to `1.12.4` is running, including Docker images.\n- Check whether the Langflow instance is reachable from the internet or from untrusted users.","plain_action":"","needs_analyst":true,"not_affected_if":["managed-hosting","versions-outside-range","no-untrusted-accounts"],"who_is_affected":"Teams running self-hosted IBM Langflow OSS between 1.0.0 and 1.12.4 are exposed, especially where many people or external users have accounts. The flaw needs an authenticated session, so instances restricted to trusted accounts are at lower risk but still exposed to any compromised login. Deployments on managed hosting controlled by someone else should be checked with that provider.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000741,"input_tokens":4095,"output_tokens":662,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-107329':13A,16A '-2026':12A,15A '1.0.0':32B,78C '1.12.4':34B,80C 'account':66B 'ai':18B,21B 'ai-app':17B 'ai-tool':20B 'allow':82C 'app':19B 'arbitrari':6A,43B,89C 'attack':61B,86C 'authent':2A,85C 'code':7A,9A,44B,50B,68B,90C,96C 'control':56B,94C 'could':81C 'cve':11A,14A 'due':91C 'execut':59B,69B,88C 'generat':10A,51B,97C 'get':67B 'hold':63B 'host':27B,72B 'ibm':28B,75C 'improp':93C 'langflow':1A,23B,29B,74B,76C 'let':35B 'log':38B 'logged-in':37B 'oss':30B,77C 'path':52B 'proper':55B 'python':24B 'remot':40B,84C 'run':5A,42B,73B 'self':26B 'self-host':25B 'server':47B 'tool':22B 'user':3A,41B 'valid':65B 'version':31B","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted IBM Langflow OSS between 1.0.0 and 1.12.4 are exposed, especially where many people or external users have accounts. The flaw needs an authenticated session, so instances restricted to trusted accounts are at lower risk but still exposed to any compromised login. Deployments on managed hosting controlled by someone else should be checked with that provider.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:17:50+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107329","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107329","severity":null,"published_at":"2026-10-29T16:17:50+00:00","modified_at":"2026-10-29T16:17:50+00:00","first_seen_at":"2026-10-29T16:25:55+00:00","fetched_at":"2026-10-29T16:25:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}