{"id":"CVE-2026-18894","kind":"vulnerability","aliases":["CVE-2026-18894"],"related":[],"title":"Langflow: public workflows can run stored Python components under owner's context","description":"IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to trigger pre-existing stored Python component code in a public workflow, executing it under the flow owner's runtime context within the server process. This bypasses the intended trust boundary where public execution paths are restricted to server-trusted component code.","summary":"IBM Langflow OSS 1.0.0 through 1.12.4 lets a remote attacker trigger Python component code already stored in a public workflow. That code runs inside the server process under the flow owner's runtime context, bypassing the intended trust boundary for public execution.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","langflow","python","self-hosted"],"not_affected_if":["no-public-flows","version-outside-range"],"how_to_check":"- Check the installed Langflow version, for example with `pip show langflow`, and see whether it falls in 1.0.0 through 1.12.4.\n- Look for flows marked public that contain custom Python components.","fix":"- Langflow OSS: move to a version newer than `1.12.4`; the sources do not name the exact fixed version.","status":"open","published_at":"2026-10-29T16:18:08+00:00","first_seen_at":"2026-10-29T16:25:59+00:00","triaged_at":"2026-10-29T16:31:21+00:00","updated_at":"2026-10-29T16:31:21+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-29T16:31:21Z","model":"claude-haiku-5-5","output":{"fix":"- Langflow OSS: move to a version newer than `1.12.4`; the sources do not name the exact fixed version.","reach":"internet","title":"Langflow: public workflows can run stored Python components under owner's context","impact":"high","summary":"IBM Langflow OSS 1.0.0 through 1.12.4 lets a remote attacker trigger Python component code already stored in a public workflow. That code runs inside the server process under the flow owner's runtime context, bypassing the intended trust boundary for public execution.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["langflow","self-hosted","python"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker runs server-side Python under the flow owner's context","analyst_note":"Confirm the fixed version and whether a public-flow setting is required to be exposed, using the IBM advisory linked from the NVD entry.","how_to_check":"- Check the installed Langflow version, for example with `pip show langflow`, and see whether it falls in 1.0.0 through 1.12.4.\n- Look for flows marked public that contain custom Python components.","plain_action":"","needs_analyst":true,"not_affected_if":["no-public-flows","version-outside-range"],"who_is_affected":"Teams running self-hosted Langflow OSS from 1.0.0 through 1.12.4 that publish workflows for public execution. The exposure depends on whether public flows contain stored Python components. Deployments with no public flows, or on versions outside the range, can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000704,"input_tokens":4144,"output_tokens":579,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-18894':15A,18A '-2026':14A,17A '1.0.0':30B,72C '1.12.4':32B,74C 'ai':20B 'ai-tool':19B 'allow':76C 'alreadi':41B 'attack':36B,79C 'boundari':65B,111C 'bypass':61B,107C 'code':40B,48B,88C,123C 'compon':8A,39B,87C,122C 'context':12A,60B,101C 'could':75C 'cve':13A,16A 'execut':68B,93C,114C 'exist':84C 'flow':56B,97C 'host':26B 'ibm':27B,69C 'insid':50B 'intend':63B,109C 'langflow':1A,22B,28B,70C 'let':33B 'oss':29B,71C 'owner':10A,57B,98C 'path':115C 'pre':83C 'pre-exist':82C 'process':53B,105C 'public':2A,45B,67B,91C,113C 'python':7A,23B,38B,86C 'remot':35B,78C 'restrict':117C 'run':5A,49B 'runtim':59B,100C 'self':25B 'self-host':24B 'server':52B,104C,120C 'server-trust':119C 'store':6A,42B,85C 'tool':21B 'trigger':37B,81C 'trust':64B,110C,121C 'within':102C 'workflow':3A,46B,92C","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted Langflow OSS from 1.0.0 through 1.12.4 that publish workflows for public execution. The exposure depends on whether public flows contain stored Python components. Deployments with no public flows, or on versions outside the range, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:18:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_by":"psirt@us.ibm.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-18894","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18894","severity":null,"published_at":"2026-10-29T16:18:08+00:00","modified_at":"2026-10-29T16:18:08+00:00","first_seen_at":"2026-10-29T16:25:59+00:00","fetched_at":"2026-10-29T16:25:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}