CVE-2026-107329: RCE in IBM Langflow OSS 1.0.0-1.12.4

IBM Langflow OSS versions 1.0.0 through 1.12.4 contain a critical vulnerability in code generation control. CVE-2026-107329 allows authenticated remote attackers to execute arbitrary code on the affected server through injection in generation parameters.

The assigned CVSS score is 9.9 critical, the maximum value on the severity scale. The vulnerability was published to NVD on October 29, 2026. Social media platforms show active discussion: 3 posts in the last 24 hours emphasizing the urgency of patching. From available data, the existence of public functional exploits is not confirmed, however the risk remains extreme for all organizations using Langflow OSS.

System administrators and CISOs must prioritize immediate update of Langflow OSS to version higher than 1.12.4. Examine access and activity logs to detect anomalous logins or suspicious code executions. Contact IBM through official channels to obtain detailed release notes and verify patch compatibility with your environment. Until the update is completed, restrict access exclusively to trusted users and implement intensive monitoring of all operations.