CVE-2026-93447
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
IBM Langflow OSS versions 1.0.0 through 1.12.2 could allow an attacker with access to the server secret and Redis write access to submit a malicious serialized cache value. When the value was retrieved, deserialization could have executed attacker-controlled code with the privileges of the service process.
Risk Assessment
Risk of remote code execution with service privileges, potentially leading to full system compromise.
Recommendation
Update IBM Langflow OSS to the latest version that mitigates unsafe deserialization.
Other vulnerabilities in IBM Langflow OSS
See all- CVE-2026-12944Critical
IBM Langflow OSS 1.0.0 through 1.10.0 allows attackers to execute arbitrary Python code with root privileges (UID=0) on the Langflow server by submitting components containing socket or urllib imports. This enables AWS credential theft via IMDSv1 SSRF, arbitrary file exfiltration from the container filesystem, and lateral movement to internal services (PostgreSQL, Redis) within the Docker network. The scanner incorrectly returns "validated": true, providing a false security signal.
- CVE-2026-81204Critical
IBM Langflow OSS versions 1.0.0 through 1.11.5 allow a remote attacker to execute arbitrary code due to code injection during graph construction.
- CVE-2026-79724Critical
IBM Langflow OSS versions 1.0.0 through 1.11.5 allow a remote attacker to execute arbitrary OS commands due to improper neutralization of special elements used in an OS command.
- CVE-2026-85025Critical
IBM Langflow OSS versions 1.0.0 through 1.11.5 allow an unauthenticated attacker to execute arbitrary code and access or modify chat sessions through publicly shared MCP project endpoints due to improper enforcement of public-flow security restrictions and session isolation controls.
- CVE-2026-19295Critical
IBM Langflow OSS versions 1.0.0 through 1.11.1 allow an authenticated attacker to execute arbitrary operating system commands in the server process by saving a flow with a crafted type field value and triggering a build of a wrapper flow that references it. This allows privilege escalation from 'authenticated flow user' to arbitrary OS-level command execution, bypassing the LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false policy.
- CVE-2026-19286Critical
IBM Langflow OSS versions 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary code due to improper enforcement of security restrictions on the A2A public endpoint.
- CVE-2026-19297Critical
IBM Langflow OSS 1.0.0 through 1.9.6 could allow a remote attacker to obtain unauthorized access to user accounts due to improper restriction of excessive authentication attempts.
- CVE-2026-12946Critical
IBM Langflow OSS versions 1.0.0 through 1.10.0 could allow a remote attacker to inject arbitrary code on the system due to improper control of user input code.
- CVE-2026-13435Critical
IBM Langflow OSS versions 1.0.0 through 1.10.1 contain an improper input validation vulnerability in the PythonREPL sandbox implementation.
- CVE-2026-12940Critical
IBM Langflow OSS versions 1.0.0 through 1.10.1 are vulnerable to unauthenticated remote code execution via environment variable injection in the MCP stdio launcher. The vulnerability is due to an incomplete blocklist of dangerous environment variables (missing SHELLOPTS, BASHOPTS, and PS4) in src/lfx/src/lfx/base/mcp/util.py.
Original NVD description (English source)
IBM Langflow OSS 1.0.0 through 1.12.2 could allow an attacker with access to the server secret and Redis write access to submit a malicious serialized cache value. When the value was retrieved, deserialization could have executed attacker-controlled code with the privileges of the service process.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS