Live › vulnerability › CVE-2026-90991
IBM Langflow OSS versions 1.0.0 through 1.12.4 allow a logged-in remote user to trigger unlimited resource allocation. An attacker can use this to make the service unavailable.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:26 UTC. All times on this page are UTC.
Self-hosted Langflow OSS 1.0.0 through 1.12.4 where outsiders can hold or obtain a valid account; any logged-in user can exhaust server resources and make the service unavailable. IBM does not name the vulnerable endpoint. Instances on 1.12.5 or later, or reachable only by fully trusted users, can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Langflow OSS | vendor | >= 1.0.0, <= 1.12.4 | 1.12.5 |
langflow --version or the package manager, and compare it against the affected range 1.0.0 to 1.12.4.Upgrade Langflow OSS to 1.12.5 (IBM: back up the installation, follow the Prepare to upgrade steps, test flows).
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to cause a denial of service due to allocation of resources without limits or throttling.
This page as .md · .json · in your agent: get_signal("CVE-2026-90991")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.