Loading vulnerability…
Authenticated remote code execution in IBM Langflow OSS
CVE-2026-93449 is an improper control of code generation vulnerability in IBM Langflow OSS versions 1.0.0 through 1.12.2. A remote authenticated attacker could exploit the flaw to execute arbitrary code on the affected system. The specific vulnerable function and exploit input are not identified.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits arbitrary code execution on the affected system by an authenticated remote attacker. The execution privileges and further consequences are not specified.
If you can’t patch tonight, do this now.
No vendor workaround is identified. Pending upgrade, restrict network access to affected deployments and limit authenticated access to trusted users as interim risk-reduction measures; these restrictions are not a confirmed fix.
Patch, then assume compromise.
Upgrade IBM Langflow OSS to version 1.12.3 or later, following the IBM security bulletin's remediation guidance. The bulletin recommends version 1.12.3 to address the affected vulnerabilities.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.