Vulnerabilities

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a…

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory.

Read at NIST National Vulnerability Database (CVE API 2.0)

Vendor

IBM

Product

Langflow OSS

CVSS v3.1

6.5 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness

CWE-22

Exposure class

AI infrastructure

NVD status

Awaiting Analysis

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-104309 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 14
   CVE NVD 2d ago

   IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to overwrite arbitrary files due to improper limitation of a…

   CVSS 6.5 CVE-2026-77819 IBM
2. 21
   CVE NVD 2d ago

   IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary commands due to improper control of code…

   CVSS 8.8 CVE-2026-110309 IBM
3. 29
   CVE NVD 2d ago

   IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to execute arbitrary code due to improper control of code generation.

   CVSS 9.8 CVE-2026-110186 IBM
4. 29
   CVE NVD 2d ago

   IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code…

   CVSS 9.9 CVE-2026-107329 IBM
5. 29
   CVE NVD 2d ago

   IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of code in…

   CVSS 9.9 CVE-2026-107328 IBM
6. 29
   CVE NVD 2d ago

   IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to missing authorization.

   CVSS 9.9 CVE-2026-107327 IBM
7. 21
   CVE NVD 2d ago

   IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special…

   CVSS 8.8 CVE-2026-107326 IBM
8. 29
   CVE NVD 2d ago

   IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used…

   CVSS 9.8 CVE-2026-104339 IBM
9. 21
   CVE NVD 2d ago

   IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special…

   CVSS 8.8 CVE-2026-104328 IBM
10. 21
    CVE NVD 2d ago

    IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to deserialization of untrusted data.

    CVSS 8.8 CVE-2026-104324 IBM
11. 21
    CVE NVD 2d ago

    IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker who could reach the message broker to execute arbitrary code on the system due to…

    CVSS 8.1 CVE-2026-104317 IBM
12. 14
    CVE NVD 2d ago

    IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to cause a denial of service due to improper neutralization of…

    CVSS 4.3 CVE-2026-104308 IBM
13. 21
    CVE NVD 2d ago

    IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper access control.

    CVSS 8.5 CVE-2026-103092 IBM
14. 21
    CVE NVD 2d ago

    IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special…

    CVSS 8.8 CVE-2026-101288 IBM