CVE-2026-107327: remote execution in IBM Langflow OSS

CVE-2026-107327 concerns a missing authorization flaw in IBM Langflow OSS, versions 1.0.0 through 1.12.4. The vulnerability allows an authenticated user to execute arbitrary code remotely on the server. CVSS is 9.9 (critical), indicating extreme risk for any organization exposing this application. It is a remote code execution (RCE) flaw requiring authentication but no additional authorization for impact.

The flaw was published on NVD on 29 October 2026. Signals on X show growing awareness with 4 posts in the last 24 hours, though with modest engagement (3 total interactions). No public exploit is yet known on GitHub. IBM's patch status has not been confirmed in available official data.

IT teams must immediately inventory all Langflow OSS instances in use and identify those within versions 1.0.0 to 1.12.4. Contact IBM for information on patch availability. Meanwhile, restrict authenticated access to this application via firewall and VPN, and enable detailed logging on code execution to detect anomalous activity.