Langflow OSS has been found to contain multiple vulnerabilities, potentially allowing remote code execution and other security breaches. These vulnerabilities affect versions 1.0.0 through 1.12.4, according to reports.
CVE-2026-107366 enables authenticated users to delete messages, overwrite content, or hijack sessions. CVE-2026-110196 and CVE-2026-107328 allow remote code execution through improper input handling and code neutralization.
CVE-2026-110245 exposes sensitive information due to inadequate authentication measures. Exploitation status cannot be confirmed because KEV, SSVC, PoC and EPSS indicators were not provided.
IBM recommends users upgrade to Langflow OSS version 1.12.5 to mitigate these security issues. The vulnerabilities require no victim interaction and are considered low complexity, increasing the risk of successful attacks.
Successful exploitation could lead to unauthorized access to sensitive data, workflow alterations, or service disruptions.