Incident Response Checklist for Langflow OSS 1.0.0 Through 1.12.2
IBM has published a security bulletin covering 25 vulnerabilities in Langflow OSS versions 1.0.0 through 1.12.2. No exploitation in the wild has been reported, and no public proof-of-concept has been confirmed, so this is a preventive response rather than a breach investigation.
Vulnerability Overview
Two flaws justify treating the platform as potentially compromised. CVE-2026-104334 stems from improper control of code generation, and CVE-2026-93674 involves improper neutralization of special elements used in an OS command. Both need no login and no user interaction, so any prior exposure window counts.
Mechanism and Exploitation Conditions
1. Establish the Exposure Window
Determine when each Langflow instance was reachable from an untrusted network and which version it ran. Affected versions are 1.0.0 through 1.12.3's predecessor set, that is, 1.0.0 through 1.12.2.
2. Review Anonymous Reachability
CVE-2026-93675, which carries a CVSS score of 8.8, abuses dependency confusion and needs no login, although a user must take an action for it to be triggered. Treat both the automated and the user-triggered classes as in scope.
3. Check the Containment Layer
CVE-2026-97655 slips past an incomplete blocklist in the code security scanner, and CVE-2026-97676 enables a sandbox escape. Review flow-creation activity for the same period, because these paths require an account.
4. Inspect Data Paths
Path traversal bugs let users read or write files outside allowed folders, and CVE-2026-97677 lets a flow author write files into any directory writable by the service account and read configuration files, secrets, or database files. Other bugs leak credentials or poison the vertex result cache. Finally, CVE-2026-93679 crashes the server with oversized ZIP archives, so unexplained restarts merit a look.
5. Rotate and Patch
Impact
The batch's shape determines the checklist: two anonymous code execution paths, a broad authenticated cluster with 15 of these flaws able to lead to code execution, and a set of data and availability issues that leave traces in logs and file systems.
Affected Products and Scope
All 25 flaws affect Langflow OSS 1.0.0 through 1.12.2. Of the 25 flaws, 2 are critical, 19 are high and 4 are medium. CVE-2026-93447 abuses deserialization of cached Redis values but requires the server secret and Redis write access, so confirm who held those privileges.
Remediation and Mitigations
Upgrade to Langflow 1.12.3. IBM strongly recommends addressing the vulnerability now. Until the upgrade is done, keep Langflow off the public internet and limit who can create or edit flows. After patching, rotate any API keys and credentials that are stored in the platform.
