LANGFLOW OSS · CVE-2026-97677 · AI agents & MCP
FIX → 1.12.3 ✓ verified
Langflow is an open-source framework for building AI agent and LLM workflows. An authenticated user who can author flows can write attacker-chosen content into any directory the service account can write to, and read arbitrary files the service process can access, including configuration files, secrets and database files.
first public Nov 8, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Self-hosted Langflow OSS 1.0.0 through 1.12.2 where more than one person can log in and author flows. An authenticated flow author can write attacker-controlled content into any directory the service account can write to, and via a crafted on-disk index read files the service can access (config, secrets, database files under the data directory). Skip it if you are on 1.12.3 or later, or only a single trusted builder uses the instance.
Not affected if managed-hosting, single-trusted-author
Who cares langflow, python, self-hosted
pip show langflow or langflow --version (or check the container image tag)1.0.0 through 1.12.2 are affected; 1.12.3 is fixedIBM Langflow OSS 1.0.0 through 1.12.2 An authenticated flow author could write attacker-controlled file content into any directory writable by the service account, bypassing the platform's local file access isolation safeguard. Via a crafted on-disk index, the attacker could also read the contents of arbitrary files accessible to the service process — including configuration files, secrets, or database files stored under the application's data directory.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 1.12.3
1.12.3 or later (IBM bulletin, 2 Oct 2026)