Disclosed vulnerability
IBM Langflow OSS October 2026 bulletin: 25 flaws including two unauthenticated remote code execution bugs rated CVSS 9.8 (fixed in 1.12.3)
AIR-2026-0269 AIR record · 2026-10-ibm-langflow-oss-october-bulletin
From the supporting source
Langflow OSS could allow a remote attacker to execute arbitrary code due to improper control of code generationibm.com
The record
Disclosed
2026-10-02
Vendor
IBM
Product
Langflow OSS
Risk domain
Access control and permissions › Privilege escalation
Also touches
Data exfiltration channels, Uncontrolled resource consumption
System type
Generative model
Who acted
AI was the target — conventional vulnerabilities in an agent-building platform; no model action in the chain
Attack surface
Agent framework
Autonomy level
Assistant
Initial vector
Unauthenticated network request
Impact type
Remote code execution, Data exfiltration, Unauthorized data access, Denial of service
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0055 – Unsecured Credentials
- NIST AI RMF
- GOVERN 6.1
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool misuse
- Mitigation
- Apply least-privilege principle; Regular policy audits.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Langflow OSS 1.0.0 through 1.12.2
Capability abused
Defense & remediation
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
Langflow OSS 1.12.3 (IBM lists no workarounds)
Taxonomy & references
Curator notes
IBM security bulletin dated 2026-10-02 listing 25 CVE entries. Two are rated CVSS 9.8 with no privileges required: CVE-2026-104334 (improper control of code generation) and CVE-2026-93674 (improper neutralization of special elements in an OS command); CVE-2026-93675 (dependency confusion, user interaction required) is also unauthenticated at 8.8. Most others require an authenticated flow author. The bulletin states that depending on deployment configuration an attacker could execute code, read or modify data, disclose information or cause denial of service; it does not state that any of these flaws has been exploited, and none is claimed here. Kept separate from the September 8 IBM Langflow disclosure (fixed in 1.11.6), which is a different bulletin and release; this is the next batch against later versions.
Supporting sources
Cite as
Enkrypt AI. "IBM Langflow OSS October 2026 bulletin: 25 flaws including two unauthenticated remote code execution bugs rated CVSS 9.8 (fixed in 1.12.3)". AIR, AIR-2026-0269. https://agentincident.vercel.app/i/AIR-2026-0269/ (accessed 2026-10-19).