Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-104316

IBM Langflow OSS 1.0.0 through 1.12.3 could allow an authenticated attacker to cancel any victim's…

Risk score
44/100
CVSS
6.5 v3.1
Exploit chance (30 days)
0.3%
Published
29 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
IBM Langflow OSS 1.0.0 through 1.12.3 could allow an authenticated attacker to cancel any victim's running background workflow job by sending a single HTTP request, resulting in loss of in-progress compute work with no flow-level permission check.
Affected
Langflow
Fix
Apply the vendor's security update; see the linked advisory.
Exploitation
No known exploitation

Story map

Story map: LangflowTHE FLAWSTHE FIXCVE-2026-104316IBM Langflow OSS 1.0.0through 1.12.3 could allow anauthenticated attacker to…CVSS 6.5 · EPSS 0%CVE-2026-93674Code injection can lead toremote code executionCVSS 9.8 · EPSS 15%CVE-2026-10561Langflow:PythonREPLComponentexecutes unsandboxed Python…CVSS 10.0 · EPSS 1%CVE-2026-8505Langflow: UnauthenticatedFlow Execution via WebhookAuthentication BypassCVSS 9.8 · EPSS 1%FixApply the vendor's securityupdate; see the linked advisory.Who is exposedLangflowRED · ACT TODAYLangflowIBM Langflow OSS 1.0.0 through1.12.2 could allow a remoteattacker to execute arbitrarycode due to improperneutralization of specialelements used in an OS command.Where it standsNo known exploitationCONNECTS TOSame weaknessCWE-285 (CWE-285)69 other warnings in 30 days →Same productEarlier Langflow warnings57 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Langflow: Red, act today. IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.

The flaws

  • CVE-2026-104316: IBM Langflow OSS 1.0.0 through 1.12.3 could allow an authenticated attacker to cancel any victim's… (CVSS 6.5 · EPSS 0%)
  • CVE-2026-93674: Code injection can lead to remote code execution (CVSS 9.8 · EPSS 15%)
  • CVE-2026-10561: Langflow: PythonREPLComponent executes unsandboxed Python code, enabling authenticated RCE and privilege escalation (CVSS 10.0 · EPSS 1%)
  • CVE-2026-8505: Langflow: Unauthenticated Flow Execution via Webhook Authentication Bypass (CVSS 9.8 · EPSS 1%)

The fix

Fix: Apply the vendor's security update; see the linked advisory.

Who is exposed: Langflow

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 6.5 medium

References

Original description

IBM Langflow OSS 1.0.0 through 1.12.3 could allow an authenticated attacker to cancel any victim's running background workflow job by sending a single HTTP request, resulting in loss of in-progress compute work with no flow-level permission check.

Last activity 29 Oct 2026. Patch Forecast updates every hour.