External risk intelligence

IBM Langflow OSS Code Generation Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-110186

IBM Langflow is a platform for building and deploying AI workflows and applications. These systems are commonly deployed as web-based interfaces, API endpoints, or services intended for user interaction, which places them in a position where they are frequently exposed to network or internet access in many deployment scenarios.

Code Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in IBM Langflow OSS, a platform used for building and deploying AI workflows. The flaw could allow unauthorized remote execution of code, potentially impacting systems that process or generate code. The main concern is confirming relevance and exposure for these types of systems.

Code generation flaw allows remote code execution.
Critical vulnerability in AI workflow platform.
Confirm relevance and exposure of AI systems.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted input over the network to an exposed instance of IBM Langflow. The vulnerable code generation mechanism can then be manipulated to execute arbitrary commands, potentially leading to a complete compromise of the affected system.

No authentication or user interaction required.
Improper control of code generation.
Remote code execution.

Live Threat

Current exploitation, exposure, and threat context

IBM Langflow OSS, when deployed with its default configurations, could allow a remote attacker to execute arbitrary code. This occurs due to insufficient control over code generation, potentially impacting the integrity and availability of the system.

System code and configuration.
Attacker sends specially crafted requests.
System compromise and potential data exposure.

Operational Fix

Recommended remediation, mitigation, and detection steps

IBM Langflow OSS, used for building and deploying AI workflows, presents a critical risk of remote code execution. Owners of applications leveraging this technology must first identify all deployments, assess their external reachability and business criticality, and then confirm the responsible team before planning remediation.

Application owners should lead remediation efforts.
Verify external reachability and business criticality.
Plan remediation based on confirmed risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is IBM Langflow OSS?

IBM Langflow OSS is an open-source platform designed for building, testing, and deploying AI-driven workflows. It provides a visual interface and backend services that developers use to orchestrate complex data processing tasks, making it a central hub for managing automation pipelines and AI model interactions.

What does CWE-94 mean for CVE-2026-110186?

CWE-94 refers to improper control of code generation. In the context of this CVE, it means the application does not sufficiently validate or sanitize user-supplied input before using it to generate or execute code. An attacker can exploit this weakness to inject malicious instructions that the system processes as if they were legitimate commands.

How does an attacker trigger this vulnerability?

An attacker triggers this issue by sending specially crafted network requests to the Langflow instance. The system processes these requests through its vulnerable code generation mechanism, which leads to unauthorized execution. Simply browsing the application's interface without sending malicious input does not trigger the bug.

Is my instance of IBM Langflow at risk?

Halo Surface Signal indicates that Langflow instances are often deployed as web-based interfaces or API endpoints, making them frequently accessible over a network. If your instance is reachable from the internet, it is at higher risk of remote exploitation. Internal-only instances are generally safer but still warrant investigation.

What should I do if I run IBM Langflow?

Start by identifying all active deployments of Langflow within your environment. Once you have a list, verify which instances are exposed to external networks and determine their business criticality. Engage the teams responsible for these systems to assess their configuration and prepare for necessary updates or hardening steps.

References

www.ibm.com/support/pages/node/7294467

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.