{"id":"CVE-2026-110309","kind":"vulnerability","aliases":["CVE-2026-110309"],"related":[],"title":"Langflow: authenticated users can run arbitrary commands via code generation","description":"IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary commands due to improper control of code generation.","summary":"IBM Langflow OSS versions 1.0.0 through 1.12.4 let a logged-in user run arbitrary operating system commands on the server. The flaw comes from improper control of code generation, so a crafted request is turned into code that the server executes.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-apps","ai-tooling","langflow","python","self-hosted"],"not_affected_if":["managed-hosting","version-outside-range"],"how_to_check":"- Check the installed Langflow version (for example `pip show langflow`, or the image tag if run in Docker) and see whether it falls in `1.0.0` through `1.12.4`.\n- Confirm whether the instance is reachable from outside the network and who holds an account on it.","fix":"- Move Langflow OSS to a version later than `1.12.4`; the sources do not name the exact fixed release.","status":"open","published_at":"2026-10-29T16:17:57+00:00","first_seen_at":"2026-10-29T16:25:56+00:00","triaged_at":"2026-10-29T16:29:13+00:00","updated_at":"2026-10-29T16:29:13+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-29T16:29:13Z","model":"claude-haiku-5-5","output":{"fix":"- Move Langflow OSS to a version later than `1.12.4`; the sources do not name the exact fixed release.","reach":"internet","title":"Langflow: authenticated users can run arbitrary commands via code generation","impact":"high","summary":"IBM Langflow OSS versions 1.0.0 through 1.12.4 let a logged-in user run arbitrary operating system commands on the server. The flaw comes from improper control of code generation, so a crafted request is turned into code that the server executes.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["langflow","self-hosted","python","ai-apps"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker runs commands on the Langflow server as an authenticated user","analyst_note":"Confirm the fixed version and any workaround from IBM's security bulletin for Langflow OSS; the NVD entry alone does not name them.","how_to_check":"- Check the installed Langflow version (for example `pip show langflow`, or the image tag if run in Docker) and see whether it falls in `1.0.0` through `1.12.4`.\n- Confirm whether the instance is reachable from outside the network and who holds an account on it.","plain_action":"","needs_analyst":true,"not_affected_if":["managed-hosting","version-outside-range"],"who_is_affected":"Teams running self-hosted IBM Langflow OSS in the 1.0.0 to 1.12.4 range are exposed, especially where many people hold accounts or the instance is reachable from the internet. Managed or hosted Langflow deployments run by someone else are a matter for that provider. The sources do not say whether default configuration is affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000723,"input_tokens":4095,"output_tokens":626,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-110309':13A,16A '-2026':12A,15A '1.0.0':32B,73C '1.12.4':34B,75C 'ai':18B,21B 'ai-app':17B 'ai-tool':20B 'allow':77C 'app':19B 'arbitrari':6A,42B,84C 'attack':81C 'authent':2A,80C 'code':9A,56B,65B,91C 'come':51B 'command':7A,45B,85C 'control':54B,89C 'could':76C 'craft':60B 'cve':11A,14A 'due':86C 'execut':69B,83C 'flaw':50B 'generat':10A,57B,92C 'host':27B 'ibm':28B,70C 'improp':53B,88C 'langflow':1A,23B,29B,71C 'let':35B 'log':38B 'logged-in':37B 'oper':43B 'oss':30B,72C 'python':24B 'remot':79C 'request':61B 'run':5A,41B 'self':26B 'self-host':25B 'server':48B,68B 'system':44B 'tool':22B 'turn':63B 'user':3A,40B 'version':31B 'via':8A","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted IBM Langflow OSS in the 1.0.0 to 1.12.4 range are exposed, especially where many people hold accounts or the instance is reachable from the internet. Managed or hosted Langflow deployments run by someone else are a matter for that provider. The sources do not say whether default configuration is affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:17:57+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110309","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110309","severity":null,"published_at":"2026-10-29T16:17:57+00:00","modified_at":"2026-10-29T16:17:57+00:00","first_seen_at":"2026-10-29T16:25:56+00:00","fetched_at":"2026-10-29T16:25:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}