Live › vulnerability › CVE-2026-18894
IBM Langflow OSS 1.0.0 through 1.12.4 lets a remote attacker trigger Python component code already stored in a public workflow. That code runs inside the server process under the flow owner's runtime context, bypassing the intended trust boundary for public execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
Teams running self-hosted Langflow OSS from 1.0.0 through 1.12.4 that publish workflows for public execution. The exposure depends on whether public flows contain stored Python components. Deployments with no public flows, or on versions outside the range, can skip it.
No product ranges from the sources yet.
pip show langflow, and see whether it falls in 1.0.0 through 1.12.4.1.12.4; the sources do not name the exact fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to trigger pre-existing stored Python component code in a public workflow, executing it under the flow owner's runtime context within the server process. This bypasses the intended trust boundary where public execution paths are restricted to server-trusted component code.
This page as .md · .json · in your agent: get_signal("CVE-2026-18894")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.