---
id: "CVE-2026-107329"
kind: "vulnerability"
aliases: ["CVE-2026-107329"]
title: "Langflow: authenticated users can run arbitrary code through code generation"
severity: "critical"
cvss: 9.9
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-apps", "ai-tooling", "langflow", "python", "self-hosted"]
not_affected_if: ["managed-hosting", "no-untrusted-accounts", "versions-outside-range"]
published_at: "2026-10-29T16:17:50+00:00"
first_seen_at: "2026-10-29T16:25:55+00:00"
updated_at: "2026-10-29T16:27:12+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107329", "first_seen_at": "2026-10-29T16:25:55+00:00"}]
---

# Langflow: authenticated users can run arbitrary code through code generation

IBM Langflow OSS versions 1.0.0 through 1.12.4 let a logged-in remote user run arbitrary code on the server because the code generation path does not properly control what it executes. An attacker who holds any valid account gets code execution on the host running Langflow.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Langflow version with `langflow --version` or `pip show langflow`.
- Confirm whether any version in the range `1.0.0` to `1.12.4` is running, including Docker images.
- Check whether the Langflow instance is reachable from the internet or from untrusted users.

## Fix

- Move to a Langflow OSS version newer than `1.12.4`; the sources do not name the exact fixed release.

## Timeline

- 2026-10-29T16:25:55+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107329

## From the sources

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code generation.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_