CVE-2026-97678

Analyzed Analyzed - Analysis Complete

Remote Code Execution in IBM Langflow OSS

Publication date: 2026-10-07

Last updated on: 2026-10-08

Assigner: IBM Corporation

Description

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper input validation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-07

Last Modified

2026-10-08

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-97678

EUVD

EUVD-2026-94123

Affected Vendors & Products

Vendor	Product	Version / Range
langflow	langflow	From 1.0.0 (inc) to 1.12.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-693	The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Attack-Flow Graph

Executive Summary

This vulnerability allows a remote authenticated attacker to execute arbitrary code on affected systems due to improper input validation in IBM Langflow OSS versions 1.0.0 through 1.12.2.

Detection Guidance

This vulnerability involves improper input validation in IBM Langflow OSS versions 1.0.0 through 1.12.2, allowing remote authenticated attackers to execute arbitrary code. Detection requires checking installed versions of IBM Langflow OSS and inspecting for suspicious activity such as unexpected code execution or unauthorized commands.

Impact Analysis

An attacker could gain control of the system, steal data, install malware, or disrupt operations. Since it requires authentication, attackers need valid credentials but could escalate privileges if successful.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR (data protection) and HIPAA (health information privacy) requirements. Organizations may face fines or legal consequences for non-compliance.

Mitigation Strategies

Update IBM Langflow OSS to a version beyond 1.12.2 to address improper input validation. Restrict network access to prevent remote exploitation. Monitor for unusual activity or unauthorized code execution.

Hi! I’m here to help you understand CVE-2026-97678. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70