IBM Patches Critical Langflow and IBM MQ Code-Execution Flaws

IBM released security updates for critical and high-severity vulnerabilities affecting Langflow OSS, IBM MQ, and IBM Sterling File Gateway. Langflow OSS versions 1.0.0 through 1.10.0 are vulnerable to CVE-2026-12944 (CVSS 9.6), where an incomplete dangerous-import blocklist can let authenticated users submit components that make network connections during server-side validation. Exploitation could enable SSRF against cloud metadata services, reverse shells, file exfiltration, access to internal Docker services, and code execution as root; IBM recommends upgrading to Langflow OSS 1.10.1. IBM MQ's JMS client is affected by CVE-2026-13293 (CVSS 8.8), a Java deserialization allowlist-bypass flaw that can allow an authenticated remote attacker to execute arbitrary code when a target consumes JMS ObjectMessages.

IBM also addressed nine vulnerabilities across MQ middleware releases, including critical CVE-2026-11381 and high-severity CVE-2026-11375 and CVE-2026-11378, which may permit authenticated remote code execution, as well as CVE-2026-11726, which may expose protected information. Updates are available for supported IBM MQ 9.1 through 9.4 LTS releases; Continuous Delivery and IBM MQ 10.0 users should move to 10.0.0.5. Separately, CVE-2026-19290 (CVSS 7.5) allows unauthenticated remote access to sensitive information in Sterling File Gateway versions 6.2.0.0–6.2.0.6_1, 6.2.1.0–6.2.1.2, and 6.2.2.0–6.2.2.1; customers should apply APAR IT49875 by upgrading to 6.2.0.6_2, 6.2.1.2_1, or 6.2.2.1_1. No workarounds were provided, and IBM had not reported active exploitation of the MQ flaws.