External risk intelligence

IBM Langflow OSS Code Execution Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-107328

IBM Langflow is a visual development tool for building LLM applications. These applications and their management interfaces are commonly deployed as web-based services accessible over the network to facilitate collaborative development and service consumption, making internet or intranet-wide exposure a standard deployment pattern.

Code Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

IBM Langflow OSS, a tool for building AI applications, has a vulnerability that could allow an authenticated user to run unauthorized code. This could impact applications built with this tool if they are deployed in environments where this vulnerability is present. The main concern is confirming if our organization uses this specific software and assessing the potential exposure.

Flaw lets authenticated users run unauthorized code.
Matters if we build AI applications with this tool.
Confirm use and assess exposure to this risk.

Attack Path

How an attacker could exploit the issue

An attacker with existing authenticated access to an affected IBM Langflow instance could craft a malicious input. This input, when processed by the vulnerable `eval/exec` component, could lead to the execution of arbitrary code on the server, potentially allowing the attacker to compromise the system.

Authenticated access to the application.
Submitting specially crafted input to the application.
Remote code execution and system compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow a remote authenticated user to execute arbitrary code when improper neutralization of code in eval/exec occurs within IBM Langflow. This could impact the integrity and availability of the system, and potentially lead to unauthorized access or modification of sensitive information.

Arbitrary code execution.
Via improper code neutralization.
Compromise of system integrity.

Operational Fix

Recommended remediation, mitigation, and detection steps

Security teams and platform owners are likely responsible for addressing this vulnerability in IBM Langflow. The first practical step is to identify all deployments of IBM Langflow within your environment, determine their exposure and business criticality, and then coordinate with the application or platform owners to plan remediation.

Application or platform owners should own this issue.
Verify where IBM Langflow is deployed and exposed.
Plan and execute remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is IBM Langflow OSS?

IBM Langflow OSS is a visual development platform designed for creating and prototyping applications powered by Large Language Models (LLMs). It provides a graphical interface that lets developers drag and drop components to build complex AI workflows. Because it is used to manage and deploy AI-driven services, it is typically hosted as a web-based tool within development or production environments to enable team collaboration.

What does CVE-2026-107328 mean by improper neutralization?

This vulnerability falls under the weakness class CWE-94, which refers to the improper control of code generation. In simpler terms, the software fails to properly filter or sanitize user-provided input before passing it to functions that execute code, such as eval() or exec(). This flaw allows an attacker to send specially crafted data that the application incorrectly interprets and runs as system commands.

How does an attacker trigger this code execution?

To trigger this, an attacker must already have authenticated access to an IBM Langflow instance. They then submit malicious input through the application's interface. It is important to note that the vulnerability is not triggered by casual browsing or unauthenticated network traffic; it specifically requires the ability to interact with the application as a logged-in user to reach the vulnerable component.

Is my organization at risk from this vulnerability?

According to Halo Surface Signal, IBM Langflow is frequently deployed as a web-based service, making it accessible across internal networks or the public internet. If your team uses Langflow to manage AI workflows, your instance could be at risk if it is reachable over the network. You should verify where this software is installed to determine if it is exposed to unauthorized users.

What steps should I take if we run IBM Langflow?

Begin by identifying all active deployments of IBM Langflow within your infrastructure. Once you have a complete inventory, assess which instances are accessible to users or network segments beyond your primary developers. Coordinate with the platform or application owners to prioritize these instances and plan for the necessary updates to neutralize the vulnerable code execution path.

References

www.ibm.com/support/pages/node/7293016

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.