Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-102590

Langflow: server-side request forgery

Risk score
46/100
CVSS
7.7 v3.1
Published
29 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery vulnerability.
Affected
Langflow
Fix
Apply the vendor's security update; see the linked advisory.
Exploitation
No known exploitation

Story map

Story map: LangflowTHE FLAWSTHE FIXCVE-2026-102590Server-side request forgeryCVSS 7.7CVE-2026-93674Code injection can lead toremote code executionCVSS 9.8 · EPSS 15%CVE-2026-10561Langflow:PythonREPLComponentexecutes unsandboxed Python…CVSS 10.0 · EPSS 1%CVE-2026-55255Langflow Authorization BypassThrough User-Controlled KeyVulnerabilityCVSS 8.4 · exploitedUpgrade Langflow1.9.1or later on your release lineWho is exposedLangflowRED · ACT TODAYLangflowIBM Langflow OSS 1.0.0 through1.12.2 could allow a remoteattacker to execute arbitrarycode due to improperneutralization of specialelements used in an OS command.Where it standsExploited in the wildOn CISA's exploited list since 7 JulUS federal deadline 10 JulHOW IT UNFOLDEDOfficial record on the left, the press on the right, oldest first.7 Jul · CISAAdded to the Known Exploited Vulnerabilities list10 Jul · DeadlineUS federal agencies must have patchedCONNECTS TOSame weaknessServer-side request forgery (CWE-918)256 other warnings in 30 days →Same productEarlier Langflow warnings57 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Langflow: Red, act today. IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.

The flaws

  • CVE-2026-102590: Server-side request forgery (CVSS 7.7)
  • CVE-2026-93674: Code injection can lead to remote code execution (CVSS 9.8 · EPSS 15%)
  • CVE-2026-10561: Langflow: PythonREPLComponent executes unsandboxed Python code, enabling authenticated RCE and privilege escalation (CVSS 10.0 · EPSS 1%)
  • CVE-2026-55255: Langflow Authorization Bypass Through User-Controlled Key Vulnerability (CVSS 8.4 · exploited)

The fix

Upgrade Langflow: 1.9.1 or later on your release line

Who is exposed: Langflow

Where it stands

  • Exploited in the wild
  • On CISA's exploited list since 7 Jul
  • US federal deadline 10 Jul

How it unfolded

  1. 7 Jul, CISA (official): Added to the Known Exploited Vulnerabilities list
  2. 10 Jul, Deadline (official): US federal agencies must have patched

Connects to

Why it is Yellow

  • CVSS 7.7 high

References

Original description

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery vulnerability.

Last activity 29 Oct 2026. Patch Forecast updates every hour.