Search CVEs, research… / diras.sa
  • PATCH AVAILABLE

CVE-2026-81204: pre-auth remote code execution in IBM Langflow OSS

Remote attackers can execute arbitrary code in Langflow OSS, tracked as CVE-2026-81204, by submitting crafted input that is evaluated during graph construction. Versions from 1.0.0 through 1.11.5 are affected; the flaw is a code-injection vulnerability (CWE-94) reachable over the network without authentication or user interaction. CVSS 3.1 scores it 9.8 (critical), indicating full confidentiality, integrity, and availability impact if an attacker can reach the vulnerable service.

Published Updated Source: CVE Program, NVD, FIRST EPSS, Vendor advisory

CVSS 3.1
9.8CRITICAL
EPSS
0.0086
CWE
CWE-94
KEV DUE DATE
Not listed
PATCH
Available

DIRAS TAKE

Urgent: this is a remote, unauthenticated code execution flaw with critical impact and easy network access (CVSS 9.8). Prioritize reducing exposure of internet-facing Langflow OSS instances and applying vendor guidance immediately.

What is CVE-2026-81204?

Remote attackers can execute arbitrary code in Langflow OSS, tracked as CVE-2026-81204, by submitting crafted input that is evaluated during graph construction. Versions from 1.0.0 through 1.11.5 are affected; the flaw is a code-injection vulnerability (CWE-94) reachable over the network without authentication or user interaction. CVSS 3.1 scores it 9.8 (critical), indicating full confidentiality, integrity, and availability impact if an attacker can reach the vulnerable service.

Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Which versions of IBM Langflow OSS are affected?

BRANCHAFFECTEDFIXED
1.x1.0.0 – 1.11.5

Is CVE-2026-81204 being exploited?

There are no public reports of exploitation as of 2026-09-29.

How to fix CVE-2026-81204

  1. Apply any vendor guidance or updates for Langflow OSS as soon as they are published.
  2. Restrict network exposure: block public access to Langflow OSS services and allow connections only from trusted networks.
  3. Monitor application and host logs for suspicious activity and indicators of command execution or unexpected processes.
  4. Prepare to upgrade Langflow OSS to vendor-supplied fixed releases when they are published and tested in your environment.

Frequently asked questions

Is CVE-2026-81204 being actively exploited?

There are no public reports of exploitation of CVE-2026-81204 as of 2026-09-29.

Which Langflow OSS versions are affected by CVE-2026-81204?

Langflow OSS versions 1.0.0 through 1.11.5 are reported as affected by CVE-2026-81204.

Is there a patch for CVE-2026-81204?

The vendor indicates a patch is available, but no fixed version numbers are listed in the advisory; follow vendor guidance and apply updates when fixed releases are published.

Does CVE-2026-81204 require authentication?

No, CVE-2026-81204 is exploitable without authentication or user interaction against reachable Langflow OSS instances.

References