CVE-2026-110193

Langflow is a tool for building AI-powered workflows, and it has a built-in assistant that can write and run small bits of code for you. This flaw means someone with even a basic account on your Langflow system could trick that assistant into running commands that take control of the server it runs on — like handing a junior employee a key that accidentally also unlocks the server room.

This matters to you if you run Langflow OSS, the open-source AI workflow tool, anywhere in your environment — self-hosted, on a server, or via Docker. The risk only applies to versions 1.0.0 through 1.12.8, and it requires the attacker to already have a logged-in account on your Langflow instance, even a low-privileged one.

There are no confirmed reports of this being exploited in the wild, and no public exploit code exists yet, so this is not an emergency to drop everything for. That said, because a successful attack would hand someone full control of the server, you should schedule the upgrade in the near term rather than putting it off indefinitely.

1. Identify all Langflow OSS deployments in your environment and check their version (affected range: 1.0.0–1.12.8). 2. Upgrade to 1.13.0 or later — pip users: pip install langflow --upgrade; Docker users: pull the updated image tagged 1.13.0+ from the official repository and redeploy. 3. Review release notes on https://github.com/langflow-ai/langflow/releases for any breaking changes between your current version and 1.13.0. 4. As a temporary mitigation if upgrading isn't immediately possible, restrict which authenticated users can access the Agentic Assistant/component-code generation features, and audit existing user accounts to remove unnecessary low-privilege access. 5. No CISA KEV listing exists, so there's no federal remediation deadline — but monitor for any future KEV addition or exploit code release, as EPSS currently rates likelihood of exploitation as low but non-zero. 6. After upgrading, verify the running version in the application UI to confirm remediation.

CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) — network-exploitable, low complexity, requires low-privilege authentication, no user interaction, with high impact to confidentiality, integrity, and availability. Weakness is CWE-94 (Code Injection): the Agentic Assistant can be induced to generate component code using unblocked patterns, resulting in arbitrary OS command execution. Not listed in CISA KEV; no public exploit code on record. EPSS places predicted exploitation likelihood in the 56th percentile with a flat trend, indicating moderate-but-unconfirmed risk. Fixed in langflow 1.13.0; patch available via pip or Docker image update per vendor advisory (IBM support page and GitHub releases).