On this page (6 sections)
CVE-2026-104317 is a high-severity flaw in IBM Langflow OSS versions 1.0.0 through 1.12.3. According to the GitHub advisory, a remote attacker who can reach the message broker could execute arbitrary code on the system, because untrusted data is deserialized.
If you run Langflow yourself, whether on a server, in a container or inside a private network used by an AI team, this is worth checking today. The attack depends on network access to the message broker, so how your deployment is exposed matters a great deal.
What the flaw is
The weakness class is CWE-502, deserialization of untrusted data. Applications often turn objects into bytes to pass them between processes, for example through a message queue, and later rebuild them. If the receiving side rebuilds data that an attacker controls without strict validation, the rebuild step can be abused to run code of the attacker's choosing.
Here, the advisory description says the attacker must be able to reach the message broker. The CVSS vector lists privileges required as none and user interaction as none, and rates the impact on confidentiality, integrity and availability as high. Attack complexity is rated high, which is why the score is 8.1 rather than a critical rating.
We are not describing exploitation details, and the sources do not provide any. The GitHub advisory lists no known source code for this issue.
Who is realistically exposed
Langflow is a tool for building and running AI workflows, and it is commonly self-hosted. The risk depends on one question: can anyone who is not fully trusted open a network connection to the message broker that Langflow uses?
- Higher risk: a broker port published to the internet, a shared or flat internal network, or a container setup that maps broker ports to all interfaces.
- Lower risk: a broker reachable only from the Langflow host or a tightly restricted private segment.
- Not affected by this CVE based on the record: versions outside 1.0.0 through 1.12.3.
How to check your exposure
First find out which version you run. If Langflow was installed with pip, this read-only command prints the installed version of the package. A result from 1.0.0 to 1.12.3 is in the affected range.
pip show langflowFor container deployments, this read-only command lists running containers with their image names and published ports. Compare the image tag with the affected range, and look at the Ports column: any broker port shown as bound to 0.0.0.0 is reachable on every network interface of the host and deserves a closer look.
docker ps --format '{{.Names}}\t{{.Image}}\t{{.Ports}}'Then check from the host which services are listening and on which addresses. This read-only command lists listening TCP ports. Listeners bound to all interfaces, rather than 127.0.0.1 or a private address, are the ones to review.
ss -tlnpWhat to do now
The sources do not name a fixed Langflow version for this CVE. The IBM security bulletin is the vendor reference for Langflow OSS and lists numerous Langflow vulnerabilities. The part of it available to us does not show the entry for CVE-2026-104317, so read the bulletin directly for the remediation guidance that applies to your version.
0 of 8 done
Related Langflow issues
The IBM bulletin describes Langflow OSS as affected by multiple vulnerabilities involving code execution, server-side requests, access controls, file handling and a development workflow. Several entries are rated higher or are exploitable by authenticated users, for instance CVE-2026-104339 (code injection, CVSS 9.8 by IBM) and CVE-2026-104324 (deserialization by an authenticated attacker, 8.8). Treat the update as a full review of the bulletin, not only of this one CVE.
| CVE | Issue | CVSS |
|---|---|---|
| CVE-2026-104339 | Remote attacker, code injection via OS command neutralization | 9.8 |
| CVE-2026-104324 | Authenticated attacker, deserialization of untrusted data | 8.8 |
| CVE-2026-104328 | Authenticated attacker, code execution via OS command | 8.8 |
| CVE-2026-103092 | Authenticated attacker, SQL commands via improper access control | 8.5 |
Detection and monitoring afterwards
Since this issue is reachable over the network without credentials according to its CVSS vector, watch for signs that something other than Langflow has been talking to the broker. Useful signals include connections from addresses you do not recognize, new child processes spawned by the Langflow or broker services, and unexpected outbound connections from the host.
If Langflow sits behind a public hostname, keep an eye on the certificate and DNS records for that name so that changes do not go unnoticed. Webforta Monitor covers certificate, DNS and header-change monitoring, and the free SSL checker gives a quick one-off view. These do not detect this vulnerability and do not replace patching or network restrictions.
For general guidance on responding if you find signs of compromise, see website hacked: what to do.
Sources
This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.