Technology · IBM
IBM Langflow vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 154 vulnerabilities in IBM Langflow: 1 in the last 7 days and 108 in the last 90 days, 38 of them critical and 1 exploited in the wild. The most recent, CVE-2026-97677, was published on 8 November 2026. 34 vulnerabilities in the last four weeks, up 13% on the four before (30). 6 critical against 3.
- Last 7 days
- 1
- Last 90 days
- 108
- Critical, all time
- 38
- Exploited in the wild
- 1
About IBM Langflow
Langflow is a low-code platform for building multi-agent and RAG applications.
Latest IBM Langflow vulnerabilities
- CVE-2026-97677: IBM Langflow OSS path traversal arbitrary file read and writehighCVSS 8.1
- CVE-2026-93680: IBM Langflow OSS authentication bypasscriticalCVSS 9.8
- CVE-2026-90991: IBM Langflow OSS denial of service via resource exhaustionmediumCVSS 6.5
- CVE-2026-77819: IBM Langflow OSS path traversal arbitrary file overwritemediumCVSS 6.5
- CVE-2026-77817: IBM Langflow OSS improper sanitization of secrets in exportsmediumCVSS 6.5
- CVE-2026-18894: IBM Langflow OSS code injection in public workflow executionmediumCVSS 6.5
- CVE-2026-110309: IBM Langflow OSS improper code generation controlhighCVSS 8.8
- CVE-2026-110245: IBM Langflow OSS authentication bypass allowing sensitive information disclosurehighCVSS 7.5
- CVE-2026-110244: IBM Langflow OSS path traversal information disclosurehighCVSS 8.8
- CVE-2026-110200: IBM Langflow OSS cleartext storage of sensitive informationmediumCVSS 6.5
- CVE-2026-110196: IBM Langflow OSS authorization bypass and code executionhighCVSS 8.8
- CVE-2026-110193: IBM Langflow OSS code injection in Agentic AssistanthighCVSS 8.8
- CVE-2026-110192: IBM Langflow OSS information disclosure via insufficiently protected credentialsmediumCVSS 6.5
- CVE-2026-110190: IBM Langflow OSS path traversal arbitrary file readmediumCVSS 6.5
- CVE-2026-110186: IBM Langflow OSS improper control of code generationcriticalCVSS 9.8
- CVE-2026-107329: IBM Langflow OSS code generation remote code executioncriticalCVSS 9.9
- CVE-2026-107328: IBM Langflow OSS code injection in eval/execcriticalCVSS 9.9
- CVE-2026-107327: IBM Langflow OSS arbitrary code execution due to missing authorizationcriticalCVSS 9.9
- CVE-2026-107326: IBM Langflow OSS OS command injectionhighCVSS 8.8
- CVE-2026-104339: IBM Langflow OSS code injection in OS command executioncriticalCVSS 9.8
- CVE-2026-104331: IBM Langflow OSS server-side request forgerymediumCVSS 5.4
- CVE-2026-104328: IBM Langflow OSS code injection in OS commandhighCVSS 8.8
- CVE-2026-104324: IBM Langflow OSS unsafe deserialization remote code executionhighCVSS 8.8
- CVE-2026-104317: IBM Langflow OSS unsafe deserialization in message brokerhighCVSS 8.1
- CVE-2026-104316: IBM Langflow OSS improper authorization in workflow job cancellationmediumCVSS 6.5
Most severe IBM Langflow vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-9198: IBM Langflow OSS remote code execution via auto-login bypasscriticalexploited in the wildCVSS 9.8EPSS 1.9%
- CVE-2026-10561: IBM Langflow OSS remote code execution in PythonREPLComponentcriticalCVSS 10EPSS 0.8%
- CVE-2026-10134: IBM Langflow OSS unauthenticated RCE in PythonCodeStructuredToolcriticalCVSS 10
- CVE-2026-19295: IBM Langflow OSS eval injection in schema creationcriticalCVSS 9.9EPSS 3.3%
- CVE-2026-7873: IBM Langflow OSS code injection in code validation endpointcriticalCVSS 9.9EPSS 1.1%
- CVE-2026-107329: IBM Langflow OSS code generation remote code executioncriticalCVSS 9.9
- CVE-2026-107328: IBM Langflow OSS code injection in eval/execcriticalCVSS 9.9
- CVE-2026-107327: IBM Langflow OSS arbitrary code execution due to missing authorizationcriticalCVSS 9.9
- CVE-2026-12946: IBM Langflow OSS code injection in CUGA CodeAgentcriticalCVSS 9.9
- CVE-2026-13435: IBM Langflow OSS code injection in PythonREPL sandboxcriticalCVSS 9.9
Vulnerabilities per week
34 vulnerabilities in the last four weeks, up 13% on the four before (30). 6 critical against 3. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 1 | 0 | |
| 24 Aug 2026 | 8 | 2 | |
| 31 Aug 2026 | 17 | 0 | |
| 7 Sep 2026 | 18 | 3 | |
| 14 Sep 2026 | 6 | 1 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 24 | 2 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 1 | 0 | |
| 26 Oct 2026 | 32 | 6 | |
| 2 Nov 2026 | 1 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many IBM Langflow vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/langflow-oss)<a href="https://junglewise.ai/threats/technologies/langflow-oss"><img src="https://junglewise.ai/threats/technologies/langflow-oss/badge.svg" alt="IBM Langflow vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/langflow-oss.json, and this page as text at https://junglewise.ai/threats/technologies/langflow-oss.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "IBM Langflow vulnerabilities", https://junglewise.ai/threats/technologies/langflow-oss, 12 November 2026.