IBM bulletin details 25 Langflow vulnerabilities; upgrade to 1.12.3 advised

What happened

IBM has published a security bulletin covering 25 vulnerabilities in Langflow OSS, the open-source framework for building LLM and agent workflows, affecting every release from 1.0.0 through 1.12.2. According to an incident response checklist published on dev.to that summarizes the bulletin, the batch splits into 2 critical, 19 high and 4 medium severity issues, with fixes arriving in version 1.12.3.

No exploitation in the wild has been documented and no public proof-of-concept has been confirmed, the checklist notes, which makes this a preventive exercise rather than a breach investigation — for now.

The flaws that matter most

Two of the 25 issues stand out because they require no login and no user interaction. CVE-2026-104334 stems from weak control over code generation inside the platform, while CVE-2026-93674 is a command injection flaw in which special characters are not properly sanitized before being handed to the operating system. Because both can be triggered anonymously, the checklist advises operators to work out when each instance was reachable from an untrusted network and which version it ran, and to treat any prior exposure window as counting toward potential compromise.

A third issue, CVE-2026-93675, carries a CVSS score of 8.8 and exploits dependency confusion. It also needs no login, although a user must take some action for it to fire, which places it in a user-triggered rather than fully automated class of attack.

Authenticated attacks and data exposure

The bulk of the bulletin concerns flaws that require an account. CVE-2026-97655 slips past an incomplete blocklist in Langflow's code security scanner, and CVE-2026-97676 enables a sandbox escape. Since these paths involve logged-in users, the dev.to checklist recommends reviewing flow-creation activity across the same exposure period.

Path traversal bugs round out the data layer. CVE-2026-97677 lets a flow author write files into any directory writable by the service account and read configuration files, secrets or database files. Other issues in the batch leak credentials or poison the vertex result cache, and CVE-2026-93679 crashes the server when it processes oversized ZIP archives — so unexplained restarts merit a closer look.

Across the whole set, 15 of the 25 vulnerabilities can lead to code execution, according to the summary. One notable exception is CVE-2026-93447, which abuses deserialization of cached Redis values but only works if the attacker already holds the server secret and write access to Redis, so reviewing who held those privileges is part of assessing exposure.

What operators should do

The core remediation is simple: upgrade to Langflow 1.12.3, which IBM strongly recommends doing now rather than waiting. Until the upgrade lands, the guidance is to keep Langflow instances off the public internet and to limit who can create or edit flows. After patching, operators should rotate API keys and other credentials stored in the platform, since several of the flaws could have exposed them.

Why it matters

A single bulletin containing 25 flaws, two of which allow anonymous remote code execution with no user interaction, means any internet-facing instance running Langflow 1.0.0 through 1.12.2 should be treated as potentially compromised until it is patched, logs are reviewed and stored secrets are rotated. The current absence of public exploits is a window of opportunity, not a guarantee: open-source AI tooling has repeatedly become a target once researchers publish working techniques. Patching now, before proof-of-concept code or mass scanning appears, is dramatically cheaper than incident response later.