Live › vulnerability › CVE-2026-110193
IBM Langflow OSS versions 1.0.0 through 1.12.8 let a remote attacker with a low-privileged account make the Agentic Assistant generate or submit component code that bypasses its blocked patterns. The injected code runs arbitrary operating system commands on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
Teams running self-hosted IBM Langflow OSS from 1.0.0 through 1.12.8 where users have accounts and the Agentic Assistant is available. The attacker needs a low-privileged authenticated account, so instances with open or single-admin access are less exposed but still in range.
No product ranges from the sources yet.
langflow --version or the image tag, and compare against the affected range 1.0.0 through 1.12.8.1.12.8; the sources do not name the exact fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker with a low-privileged authenticated account to cause the Agentic Assistant to generate or submit component code using these unblocked patterns, resulting in arbitrary operating system command execution on the server.
This page as .md · .json · in your agent: get_signal("CVE-2026-110193")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.