AI/LLM infrastructure

Langflow's 24-CVE cluster: the fix shipped ten days before the bulletin

IBM's October 2 bulletin documents 24 vulnerabilities in the open-source AI workflow builder Langflow, including two unauthenticated remote code execution bugs. The fix, v1.12.3, shipped on September 22.

Glenn Fryklund

Glenn Fryklund

— 3 min read
Share

The fix shipped before the disclosure

On September 22, 2026, the Langflow project published v1.12.3. Ten days later, on October 2, IBM published a security bulletin for the same software, and on October 7 the NVD registered 24 CVEs against it.

That sequence matters for anyone running Langflow in production: the remediation existed before the formal disclosure. The IBM bulletin lists versions 1.0.0 through 1.12.2 as affected and gives one remediation: upgrade to 1.12.3. No workarounds.

What the 24 CVEs are

The NVD batch (published 2026-10-07) contains two CRITICAL 9.8 vulnerabilities, both unauthenticated remote code execution:

  • CVE-2026-93674 — OS command injection (CWE-78-class improper neutralization)
  • CVE-2026-104334 — improper control of code generation (CWE-94)

The remaining 22 split into 18 HIGH and 4 MEDIUM. Code injection (CWE-94) is the dominant weakness class, appearing in 10 of the 24 records. The rest spread across protection mechanism failure, improper access control, path traversal, deserialization of untrusted data, insufficiently protected credentials, authorization bypass, denial of service, resource management, and information exposure.

One count discrepancy, noted for the record: the vendor bulletin references 25 CVE identifiers. The 25th, CVE-2026-97677, has no NVD record as of 2026-10-10, so this article uses the NVD count of 24 as the cited record.

What the fix release actually changed

The v1.12.3 release notes list a large batch of fix(security): commits: sandbox-escape bypass closures, SSRF guard hardening, cache deserialization RCE path elimination, component code scanner bypass closures, and Python REPL sandbox tightening.

That list is the most informative part of this disclosure. Langflow is a visual builder for LLM applications, and its power comes from letting users run code: a Python REPL component, custom components, MCP tooling. The security work in 1.12.3 is almost entirely about the boundaries around that capability, not the model.

That is the pattern worth watching in visual LLM tooling generally. The interesting vulnerabilities in these tools tend to sit in the code-execution paths and the trust boundaries between users in multi-tenant deployments, not in prompt handling. A visual builder that can run arbitrary Python on your behalf is, security-wise, closer to a shell with a GUI than to a chatbot.

Context: a second disclosure channel

Langflow's GitHub repository also carries a separate wave of repo-level security advisories from September 2026: MCP stdio OS command injection, unsandboxed PythonREPLComponent code execution, cross-user flow access, SSRF in URL-taking components, and unsafe eval in schema.py. Those predate the 1.12.3 fix and travel a different disclosure channel (community and repo advisories, not the vendor bulletin). They do not change the remediation, but they show the code-execution paths in this codebase have been under sustained review.

Exploitation status

As of 2026-10-10: no KEV listing for any of the 24 CVEs, no CISA SSVC exploitation assessment, and no in-the-wild exploitation claim by the vendor or CISA. The absence of exploitation evidence does not make the two 9.8 unauthenticated RCEs less urgent. It means the window is still open for defenders to patch before someone else gets to it.

What to do

If you run Langflow OSS below 1.12.3, upgrade to 1.12.3. The vendor lists no workarounds, so there is no interim mitigation. If you run a multi-tenant deployment, read the release notes for the sandbox and access-control changes and confirm your configuration matches the hardened defaults.

Timeline, kept separate on purpose: fix release shipped 2026-09-22; IBM bulletin published 2026-10-02; NVD records published 2026-10-07; this scan ran 2026-10-10.

Sources

Feature image: feature_langflow_24cve.png (rendered with AI; provenance in the issue comment)

Feature image caption: A visual node-based workflow graph on a dark technical background, with one node highlighted in red and marked with a warning symbol, representing a code injection path in an AI workflow builder. Rendered with AI.

This article was drafted with AI/LLM assistance and reviewed by a human before publication. All factual claims were checked against the public sources cited above. The feature image was generated with AI. See How we use AI for the full workflow.

Topics:

Read more