Loading vulnerability…
Unauthenticated Remote Code Execution in IBM Langflow OSS
CVE-2026-104334 is a code injection vulnerability affecting IBM Langflow OSS versions 1.0.0 through 1.12.2. Improper neutralization of externally influenced input during code generation allows an unauthenticated remote attacker to execute arbitrary code with the privileges of the Langflow service process. Exploitation requires no user interaction. The vulnerability is rated critical with a CVSS v3.1 score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The specific vulnerable function and request format are not identified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can compromise the confidentiality, integrity, and availability of an affected Langflow deployment. Arbitrary code execution may allow disclosure of service-accessible API keys, model credentials, environment variables, user data, prompts, and workflow configurations, as well as modification of application data and disruption of service. Further host compromise, persistence, or lateral movement depends on the service account's privileges and access to other resources.
If you can’t patch tonight, do this now.
IBM lists no vulnerability-specific workaround or mitigation. Pending upgrade, restrict network access to authorized users and trusted networks and remove unnecessary public exposure. Run Langflow with least-privileged service credentials and limit its access to sensitive resources. Monitor for unexpected child processes, suspicious command activity, unusual outbound connections, and access to service secrets; these are general detection measures rather than a verified prevention mechanism.
Patch, then assume compromise.
Upgrade affected Langflow OSS installations to version 1.12.3, the minimum fixed release, or a later stable release. Inventory deployments, verify installed versions, and prioritize upgrades for network-reachable instances. If compromise is suspected, investigate the deployment and rotate API keys, model credentials, and other secrets accessible to Langflow.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.