CVE-2026-110186: Critical RCE in IBM Langflow OSS 1.0.0-1.12.8

Critical RCE in Langflow OSS 1.0.0-1.12.8. CVSS 9.8. Improper code generation control. Update to 1.13.0 or later.

CVE-2026-110186 is a remote code execution (RCE) vulnerability in IBM Langflow OSS 1.0.0-1.12.8. The flaw stems from improper control of code generation, allowing remote attackers to execute arbitrary code. It affects organizations deploying Langflow for LLM applications in production or development environments.

The flaw scores CVSS 9.8 and is rated Critical. It requires no authentication and can be exploited remotely, with maximum impact on confidentiality, integrity, and availability. Published to NVD on 2026-10-29, it has already generated 4 posts on X in the last 24 hours. Public signals reference a Metasploit module, but no active exploitation has been reported as of writing.

IT teams and sysadmins must prioritize identifying all production and staging Langflow instances. The fix is available in version 1.13.0 and above. Immediate patching is recommended, with preliminary backup of database and critical configuration materials. In the interim, isolate critical instances from external networks and monitor logs for anomalous activity.

At a glance

What: Remote code execution (RCE) in IBM Langflow OSS due to improper control of code generation. Affects versions 1.0.0 through 1.12.8.
Severity: CVSS 9.8 – Critical. Network attack, no authentication required, maximum impact on confidentiality, integrity, and availability.
Affected versions: IBM Langflow OSS 1.0.0 through 1.12.8
Fix: Update to version 1.13.0 or higher.
Status: Published to NVD on 2026-10-29. Active discussion on X (4 posts in the last 24 hours). Metasploit module already referenced in public signals.
Action: 1) Identify production Langflow instances; 2) Test detection and isolate from network if unpatched; 3) Update to 1.13.0+; 4) Review logs for anomalous access.

Sources: NVD, CVE-2026-110186

← All articles