What it is
Langflow contains a code injection vulnerability that allows unauthenticated attackers to achieve full remote code execution on default Langflow deployments.
What to do
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Vendor notices and references
Description and required action as published by CISA. Full record at NVD.
Other IBM entries on the list
- Aspera Faspex IBM Aspera Faspex Incorrect Authorization Vulnerability CVE-2026-123218 · Nov 9, 2026
- Aspera Faspex IBM Aspera Faspex Code Execution Vulnerability CVE-2022-47986 · Feb 21, 2023
- InfoSphere BigInsights IBM InfoSphere BigInsights Invalid Input Vulnerability CVE-2013-3993 · May 25, 2022
- WebSphere Application Server and Server Hypervisor Edition IBM WebSphere Application Server and Server Hypervisor Edition Code Injection. CVE-2015-7450 · Jan 10, 2022
- Data Risk Manager IBM Data Risk Manager Directory Traversal Vulnerability CVE-2020-4430 · Nov 3, 2021
- Data Risk Manager IBM Data Risk Manager Remote Code Execution Vulnerability CVE-2020-4428 · Nov 3, 2021