# IBM Langflow vulnerabilities Source: https://junglewise.ai/threats/technologies/langflow-oss Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/langflow-oss.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 154 vulnerabilities in IBM Langflow: 1 in the last 7 days and 108 in the last 90 days, 38 of them critical and 1 exploited in the wild. The most recent, CVE-2026-97677, was published on 8 November 2026. 34 vulnerabilities in the last four weeks, up 13% on the four before (30). 6 critical against 3. ## Counts - Last 7 days: 1 - Last 30 days: 34 - Last 90 days: 108 - All time: 154 (38 critical, 1 exploited in the wild) ## About IBM Langflow Langflow is a low-code platform for building multi-agent and RAG applications. ## Latest IBM Langflow vulnerabilities - [CVE-2026-97677: IBM Langflow OSS path traversal arbitrary file read and write](https://junglewise.ai/threats/cve-2026-97677-ibm-langflow-oss-1-0-0-through-1-12-2-an-authenticated-flow) (high, CVSS 8.1, published 8 Nov 2026) - [CVE-2026-93680: IBM Langflow OSS authentication bypass](https://junglewise.ai/threats/cve-2026-93680-ibm-langflow-oss-1-0-0-through-1-12-8-could-allow-a-remote) (critical, CVSS 9.8, published 29 Oct 2026) - [CVE-2026-90991: IBM Langflow OSS denial of service via resource exhaustion](https://junglewise.ai/threats/cve-2026-90991-ibm-langflow-oss-1-0-0-through-1-12-4-could-allow-a-remote) (medium, CVSS 6.5, published 29 Oct 2026) - [CVE-2026-77819: IBM Langflow OSS path traversal arbitrary file overwrite](https://junglewise.ai/threats/cve-2026-77819-ibm-langflow-oss-1-0-0-through-1-12-3-could-allow-a-remote) (medium, CVSS 6.5, published 29 Oct 2026) - [CVE-2026-77817: IBM Langflow OSS improper sanitization of secrets in exports](https://junglewise.ai/threats/cve-2026-77817-ibm-langflow-oss-1-0-0-through-1-12-4-could-allow-a-remote) (medium, CVSS 6.5, published 29 Oct 2026) - [CVE-2026-18894: IBM Langflow OSS code injection in public workflow execution](https://junglewise.ai/threats/cve-2026-18894-ibm-langflow-oss-1-0-0-through-1-12-4-could-allow-a-remote) (medium, CVSS 6.5, published 29 Oct 2026) - [CVE-2026-110309: IBM Langflow OSS improper code generation control](https://junglewise.ai/threats/cve-2026-110309-ibm-langflow-oss-1-0-0-through-1-12-4-could-allow-a-remote) (high, CVSS 8.8, published 29 Oct 2026) - [CVE-2026-110245: IBM Langflow OSS authentication bypass allowing sensitive information disclosure](https://junglewise.ai/threats/cve-2026-110245-ibm-langflow-oss-1-0-0-through-1-12-4-could-allow-a-remote) (high, CVSS 7.5, published 29 Oct 2026) - [CVE-2026-110244: IBM Langflow OSS path traversal information disclosure](https://junglewise.ai/threats/cve-2026-110244-ibm-langflow-oss-1-0-0-through-1-12-4-could-allow-a-remote) (high, CVSS 8.8, published 29 Oct 2026) - [CVE-2026-110200: IBM Langflow OSS cleartext storage of sensitive information](https://junglewise.ai/threats/cve-2026-110200-ibm-langflow-oss-1-0-0-through-1-12-4-could-allow-a-remote) (medium, CVSS 6.5, published 29 Oct 2026) - [CVE-2026-110196: IBM Langflow OSS authorization bypass and code execution](https://junglewise.ai/threats/cve-2026-110196-ibm-langflow-oss-1-0-0-through-1-12-4-could-allow-a-remote) (high, CVSS 8.8, published 29 Oct 2026) - [CVE-2026-110193: IBM Langflow OSS code injection in Agentic Assistant](https://junglewise.ai/threats/cve-2026-110193-ibm-langflow-oss-1-0-0-through-1-12-8-could-allow-a-remote) (high, CVSS 8.8, published 29 Oct 2026) - [CVE-2026-110192: IBM Langflow OSS information disclosure via insufficiently protected credentials](https://junglewise.ai/threats/cve-2026-110192-ibm-langflow-oss-1-0-0-through-1-12-8-could-allow-a-remote) (medium, CVSS 6.5, published 29 Oct 2026) - [CVE-2026-110190: IBM Langflow OSS path traversal arbitrary file read](https://junglewise.ai/threats/cve-2026-110190-ibm-langflow-oss-1-0-0-through-1-12-4-could-allow-an) (medium, CVSS 6.5, published 29 Oct 2026) - [CVE-2026-110186: IBM Langflow OSS improper control of code generation](https://junglewise.ai/threats/cve-2026-110186-ibm-langflow-oss-1-0-0-through-1-12-8-could-allow-a-remote) (critical, CVSS 9.8, published 29 Oct 2026) - [CVE-2026-107329: IBM Langflow OSS code generation remote code execution](https://junglewise.ai/threats/cve-2026-107329-ibm-langflow-oss-1-0-0-through-1-12-4-could-allow-a-remote) (critical, CVSS 9.9, published 29 Oct 2026) - [CVE-2026-107328: IBM Langflow OSS code injection in eval/exec](https://junglewise.ai/threats/cve-2026-107328-ibm-langflow-oss-1-0-0-through-1-12-4-could-allow-a-remote) (critical, CVSS 9.9, published 29 Oct 2026) - [CVE-2026-107327: IBM Langflow OSS arbitrary code execution due to missing authorization](https://junglewise.ai/threats/cve-2026-107327-ibm-langflow-oss-1-0-0-through-1-12-4-could-allow-a-remote) (critical, CVSS 9.9, published 29 Oct 2026) - [CVE-2026-107326: IBM Langflow OSS OS command injection](https://junglewise.ai/threats/cve-2026-107326-ibm-langflow-oss-1-0-0-through-1-12-4-could-allow-a-remote) (high, CVSS 8.8, published 29 Oct 2026) - [CVE-2026-104339: IBM Langflow OSS code injection in OS command execution](https://junglewise.ai/threats/cve-2026-104339-ibm-langflow-oss-1-0-0-through-1-12-3-could-allow-a-remote) (critical, CVSS 9.8, published 29 Oct 2026) - [CVE-2026-104331: IBM Langflow OSS server-side request forgery](https://junglewise.ai/threats/cve-2026-104331-ibm-langflow-oss-1-0-0-through-1-12-3-is-vulnerable-to-server) (medium, CVSS 5.4, published 29 Oct 2026) - [CVE-2026-104328: IBM Langflow OSS code injection in OS command](https://junglewise.ai/threats/cve-2026-104328-ibm-langflow-oss-1-0-0-through-1-12-3-could-allow-a-remote) (high, CVSS 8.8, published 29 Oct 2026) - [CVE-2026-104324: IBM Langflow OSS unsafe deserialization remote code execution](https://junglewise.ai/threats/cve-2026-104324-ibm-langflow-oss-1-0-0-through-1-12-3-could-allow-a-remote) (high, CVSS 8.8, published 29 Oct 2026) - [CVE-2026-104317: IBM Langflow OSS unsafe deserialization in message broker](https://junglewise.ai/threats/cve-2026-104317-ibm-langflow-oss-1-0-0-through-1-12-3-could-allow-a-remote) (high, CVSS 8.1, published 29 Oct 2026) - [CVE-2026-104316: IBM Langflow OSS improper authorization in workflow job cancellation](https://junglewise.ai/threats/cve-2026-104316-ibm-langflow-oss-1-0-0-through-1-12-3-could-allow-an) (medium, CVSS 6.5, published 29 Oct 2026) ## Most severe IBM Langflow vulnerabilities - [CVE-2026-9198: IBM Langflow OSS remote code execution via auto-login bypass](https://junglewise.ai/threats/cve-2026-9198-ibm-langflow-oss-remote-code-execution-via-auto-login-bypass) (critical, exploited in the wild, CVSS 9.8, published 17 Jul 2026) - [CVE-2026-10561: IBM Langflow OSS remote code execution in PythonREPLComponent](https://junglewise.ai/threats/cve-2026-10561-ibm-langflow-oss-remote-code-execution-in-pythonreplcomponent) (critical, CVSS 10, published 22 Jun 2026) - [CVE-2026-10134: IBM Langflow OSS unauthenticated RCE in PythonCodeStructuredTool](https://junglewise.ai/threats/cve-2026-10134-ibm-langflow-oss-unauthenticated-rce-in-pythoncodestructuredtool) (critical, CVSS 10, published 30 Jun 2026) - [CVE-2026-19295: IBM Langflow OSS eval injection in schema creation](https://junglewise.ai/threats/cve-2026-19295-ibm-langflow-oss-eval-injection-in-schema-creation) (critical, CVSS 9.9, published 28 Aug 2026) - [CVE-2026-7873: IBM Langflow OSS code injection in code validation endpoint](https://junglewise.ai/threats/cve-2026-7873-ibm-langflow-oss-code-injection-in-code-validation-endpoint) (critical, CVSS 9.9, published 30 Jun 2026) - [CVE-2026-107329: IBM Langflow OSS code generation remote code execution](https://junglewise.ai/threats/cve-2026-107329-ibm-langflow-oss-1-0-0-through-1-12-4-could-allow-a-remote) (critical, CVSS 9.9, published 29 Oct 2026) - [CVE-2026-107328: IBM Langflow OSS code injection in eval/exec](https://junglewise.ai/threats/cve-2026-107328-ibm-langflow-oss-1-0-0-through-1-12-4-could-allow-a-remote) (critical, CVSS 9.9, published 29 Oct 2026) - [CVE-2026-107327: IBM Langflow OSS arbitrary code execution due to missing authorization](https://junglewise.ai/threats/cve-2026-107327-ibm-langflow-oss-1-0-0-through-1-12-4-could-allow-a-remote) (critical, CVSS 9.9, published 29 Oct 2026) - [CVE-2026-12946: IBM Langflow OSS code injection in CUGA CodeAgent](https://junglewise.ai/threats/cve-2026-12946-ibm-langflow-oss-code-injection-in-cuga-codeagent) (critical, CVSS 9.9, published 30 Jul 2026) - [CVE-2026-13435: IBM Langflow OSS code injection in PythonREPL sandbox](https://junglewise.ai/threats/cve-2026-13435-ibm-langflow-oss-code-injection-in-pythonrepl-sandbox) (critical, CVSS 9.9, published 30 Jul 2026) ## Vulnerabilities per week 34 vulnerabilities in the last four weeks, up 13% on the four before (30). 6 critical against 3. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 1 | 0 | 0 | | 24 Aug 2026 | 8 | 2 | 0 | | 31 Aug 2026 | 17 | 0 | 0 | | 7 Sep 2026 | 18 | 3 | 0 | | 14 Sep 2026 | 6 | 1 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 24 | 2 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 1 | 0 | 0 | | 26 Oct 2026 | 32 | 6 | 0 | | 2 Nov 2026 | 1 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other IBM technologies - [IBM API Connect](https://junglewise.ai/threats/technologies/api-connect): 207 vulnerabilities - [IBM AIX](https://junglewise.ai/threats/technologies/aix): 181 vulnerabilities - [IBM i](https://junglewise.ai/threats/technologies/i): 120 vulnerabilities - [IBM Guardium Data Protection](https://junglewise.ai/threats/technologies/guardium-data-protection): 93 vulnerabilities - [IBM PowerVM VIOS](https://junglewise.ai/threats/technologies/powervm-vios): 73 vulnerabilities - [IBM Vios](https://junglewise.ai/threats/technologies/vios): 72 vulnerabilities - [IBM WebSphere Application Server](https://junglewise.ai/threats/technologies/websphere-application-server): 67 vulnerabilities - [IBM WebSphere Application Server Liberty](https://junglewise.ai/threats/technologies/websphere-application-server-liberty): 56 vulnerabilities - [IBM Verify Identity Access](https://junglewise.ai/threats/technologies/verify-identity-access): 50 vulnerabilities - [IBM Datastage On Cloud Pak For Data](https://junglewise.ai/threats/technologies/datastage-on-cloud-pak-for-data): 48 vulnerabilities - [IBM Mq](https://junglewise.ai/threats/technologies/mq): 46 vulnerabilities - [IBM Financial Transaction Manager](https://junglewise.ai/threats/technologies/financial-transaction-manager): 45 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "IBM Langflow vulnerabilities", https://junglewise.ai/threats/technologies/langflow-oss, 12 November 2026.