IBM patches twelve flaws including unauthenticated 9.8-rated Langflow OSS bugs

IBM fixes twelve flaws, with three critical in Langflow OSS

IBM has shipped patches for twelve vulnerabilities affecting IBM MQ, the IBM MQ Appliance and Langflow OSS, according to a dev.to analysis of the September 2026 patch batch. The Dutch national CERT, NCSC-NL, consolidated the issues into advisory NCSC-2026-0392, published on 23 September 2026.

Langflow, an open-source visual builder for AI agent workflows, accounts for several of the twelve entries. Three of its CVEs — CVE-2026-79724, CVE-2026-85025 and CVE-2026-81204 — are scored 9.8 on the CVSS v3 scale and can be triggered without any authentication.

Injection flaws that need no login

Per the advisory as summarised on dev.to, the Langflow problems involve code injection and OS command injection, while the wider batch also covers missing authorization and incorrect authorization. The three unauthenticated bugs allow an attacker to execute arbitrary code or operating system commands on a vulnerable instance. The remaining Langflow entries are rated 8.8 and require an authenticated session to exploit.

Credentials are the real prize

For a team running Langflow in production, the sharpest consequence is credential exposure. A Langflow service executes flows that authenticate to model providers, datastores and third-party APIs, so anyone able to run code as that service can harvest those secrets and reuse them against other systems. In an AI stack, that can mean provider API keys, database logins and integration tokens leaking in a single compromise.

The potential attack surface is wide. A ZoomEye query for the Langflow fingerprint turned up 18,550 instances when checked on 23 September 2026, per the dev.to write-up, although that figure counts identified product assets rather than hosts confirmed vulnerable to the three CVEs. It is a ceiling, not a victim count.

Patching guidance

The advisory names the affected products but does not publish version ranges. The dev.to analysis points to IBM's own security bulletins — one for the Langflow OSS fixes, another for the IBM MQ fixes — as the place to find the fixed builds, and recommends reading them before planning an upgrade.

The suggested sequence:

• Upgrade to an IBM fixed build, then verify the running version afterwards.
• Limit who can reach the service until the rollout is complete.
• Isolate the Langflow host from secrets it does not require.
• Rotate any provider keys stored inside the platform after patching, so credentials taken before the fix cannot be replayed.

Why it matters

Langflow sits at a privileged junction in AI infrastructure: it is the component that holds the keys to model providers and datastores. Three unauthenticated flaws rated 9.8 in software with that role are a serious combination, and thousands of internet-reachable instances give attackers a broad field to scan. Because successful exploitation yields credentials rather than visible damage, an intrusion can remain silent even after the patch — which makes rotating stored keys as important as upgrading. Teams operating Langflow OSS in production should treat the advisory as an immediate patch-and-rotate exercise, not routine maintenance.