CVE-2026-107328: RCE in IBM Langflow OSS

CVE-2026-107328 addresses a critical vulnerability in IBM Langflow OSS (versions 1.0.0-1.12.4), an AI workflow builder platform. The flaw is improper neutralization of code in eval/exec that allows an authenticated attacker to execute arbitrary code on the affected system. Anyone accessing Langflow OSS with valid credentials can completely compromise the underlying infrastructure.

The vulnerability has a CVSS score of 9.9 and is classified as critical. It was published to NVD on October 29, 2026. Public signals on X (3 posts in the last 24 hours) confirm the NVD description without material divergence. No confirmed public exploit has been recorded in available data at the time of assessment, making timing critical for affected organizations.

Security teams and administrators must act immediately: conduct an inventory of production systems running Langflow OSS, verify versions in use, and apply patches as soon as they become available from the official advisory. In the interim, restrict access to administrative accounts and monitor authentication logs for anomalous activity indicating exploitation attempts.