Loading vulnerability…
Improper Access Control Enabling Arbitrary SQL Execution in IBM Langflow OSS
CVE-2026-103092 is an improper access control vulnerability in IBM Langflow OSS versions 1.0.0 through 1.12.3 that allows a remote authenticated attacker to execute arbitrary SQL commands. The affected function and precise authorization failure are not specified. Successful exploitation can compromise database confidentiality and integrity within the database privileges available to the application.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An authenticated remote attacker can execute unauthorized SQL commands, potentially reading or modifying database information within the application's database privileges. IBM assigns this vulnerability a CVSS v3.1 score of 8.5.
If you can’t patch tonight, do this now.
No workarounds or mitigations are identified in the security bulletin.
Patch, then assume compromise.
Upgrade affected installations to Langflow OSS 1.12.4. Back up the existing installation, review upgrade preparation instructions and release-specific configuration changes, install the updated version, and test existing flows.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.