{
 "public_id": "AIR-2026-0269",
 "incident_id": "2026-10-ibm-langflow-oss-october-bulletin",
 "date_disclosed": "2026-10-02",
 "title": "IBM Langflow OSS October 2026 bulletin: 25 flaws including two unauthenticated remote code execution bugs rated CVSS 9.8 (fixed in 1.12.3)",
 "attack_surface": "agent_framework",
 "initial_vector": "unauthenticated_network_request",
 "agent_capability_abused": [
  "custom_component_code_execution",
  "code_generation",
  "os_command_execution",
  "flow_file_write"
 ],
 "target_product": "Langflow OSS",
 "target_vendor": "IBM",
 "autonomy_level": "assistant",
 "impact_realized": false,
 "impact_type": [
  "remote_code_execution",
  "data_exfiltration",
  "unauthorized_data_access",
  "denial_of_service"
 ],
 "blast_radius": "Langflow OSS 1.0.0 through 1.12.2",
 "cve": [
  "CVE-2026-104334",
  "CVE-2026-93674",
  "CVE-2026-93675",
  "CVE-2026-97655",
  "CVE-2026-97671",
  "CVE-2026-97673",
  "CVE-2026-97674",
  "CVE-2026-97676",
  "CVE-2026-97677",
  "CVE-2026-97678",
  "CVE-2026-97679",
  "CVE-2026-97680",
  "CVE-2026-88962",
  "CVE-2026-93443",
  "CVE-2026-93445",
  "CVE-2026-93447",
  "CVE-2026-93448",
  "CVE-2026-93449",
  "CVE-2026-93677",
  "CVE-2026-93678",
  "CVE-2026-93679",
  "CVE-2026-101329",
  "CVE-2026-101331",
  "CVE-2026-103360",
  "CVE-2026-104335"
 ],
 "fix_shipped": "Langflow OSS 1.12.3 (IBM lists no workarounds)",
 "primary_sources": [
  "https://www.ibm.com/support/pages/node/7290694"
 ],
 "confidence": "high",
 "notes": "IBM security bulletin dated 2026-10-02 listing 25 CVE entries. Two are rated CVSS 9.8 with no privileges required: CVE-2026-104334 (improper control of code generation) and CVE-2026-93674 (improper neutralization of special elements in an OS command); CVE-2026-93675 (dependency confusion, user interaction required) is also unauthenticated at 8.8. Most others require an authenticated flow author. The bulletin states that depending on deployment configuration an attacker could execute code, read or modify data, disclose information or cause denial of service; it does not state that any of these flaws has been exploited, and none is claimed here. Kept separate from the September 8 IBM Langflow disclosure (fixed in 1.11.6), which is a different bulletin and release; this is the next batch against later versions.",
 "verified_quote": "Langflow OSS could allow a remote attacker to execute arbitrary code due to improper control of code generation",
 "class": "responsible_disclosure",
 "date_occurred": null,
 "defense_present": null,
 "defense_bypassed": true,
 "taxonomy": {
  "owasp_asi": [
   "ASI05"
  ],
  "mitre_atlas": [],
  "labels": [
   "advisory_batch",
   "unauthenticated_rce",
   "code_injection",
   "command_injection",
   "dependency_confusion"
  ]
 },
 "risk_category": "security_fraud",
 "risk_secondary": [
  "privacy"
 ],
 "risk_subcategory": "Remote Code Execution & Sandbox Escape",
 "risk_sub_secondary": [],
 "ai_entity": "generative",
 "agency": "ai_as_target",
 "agency_debatable": false,
 "agency_reason": "conventional vulnerabilities in an agent-building platform; no model action in the chain",
 "vector_family": "conventional_vulnerability",
 "vector_detail": "unauthenticated_network_request",
 "guardrail_kind": [
  "unknown"
 ],
 "guardrail_outcome": "silent",
 "xrefs": {
  "aiid": [],
  "atlas": [],
  "cve": [
   "CVE-2026-104334",
   "CVE-2026-93674",
   "CVE-2026-93675",
   "CVE-2026-97655",
   "CVE-2026-97671",
   "CVE-2026-97673",
   "CVE-2026-97674",
   "CVE-2026-97676",
   "CVE-2026-97677",
   "CVE-2026-97678",
   "CVE-2026-97679",
   "CVE-2026-97680",
   "CVE-2026-88962",
   "CVE-2026-93443",
   "CVE-2026-93445",
   "CVE-2026-93447",
   "CVE-2026-93448",
   "CVE-2026-93449",
   "CVE-2026-93677",
   "CVE-2026-93678",
   "CVE-2026-93679",
   "CVE-2026-101329",
   "CVE-2026-101331",
   "CVE-2026-103360",
   "CVE-2026-104335"
  ],
  "ghsa": []
 },
 "primary_asi": "ASI05",
 "agent_framework": "langflow",
 "model_provider": "unknown",
 "model_name": "",
 "detection_mechanism": "unknown",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "privilege_escalation",
 "eai_domain": "access_control_and_permissions",
 "eai_secondary": [
  "data_exfiltration_channels",
  "uncontrolled_resource_consumption"
 ],
 "eai_reason": "subcategory: Remote Code Execution & Sandbox Escape",
 "asi_curated": [],
 "asi_scope": "in_scope",
 "asi_provenance": "rule",
 "asi_reason": "ASI05 (impact=code_exec)",
 "submitted_by": "EAI Internal"
}