Tools AI Risk Radar ai-incident-0169
Incident record
IBM patches 25 vulnerabilities in Langflow OSS
- Severity
- Critical
- Status
- Patched
- Type
- Infra Vuln
- Target
- Langflow OSS 1.0.0–1.12.2
- Actor
- researcher
- CVE
- CVE-2026-104334; CVE-2026-97677; CVE-2026-97676; CVE-2026-101329; CVE-2026-97680; CVE-2026-97678; CVE-2026-97673; CVE-2026-97655; CVE-2026-97679; CVE-2026-101331; CVE-2026-97674; CVE-2026-103360; CVE-2026-88962; CVE-2026-93674; CVE-2026-93679; CVE-2026-93443; CVE-2026-93678; CVE-2026-93677; CVE-2026-93445; CVE-2026-93447; CVE-2026-93449; CVE-2026-93675; CVE-2026-93448; CVE-2026-97671; CVE-2026-104335
What happened
IBM’s bulletin groups 25 vulnerabilities affecting Langflow OSS, including code execution, data exposure and access-control failures. The highest CVSS 3.1 score is 9.8 Critical.
Version 1.12.3 contains the fixes. Access requirements differ by vulnerability: some require no privileges, while others need an authenticated account or additional access. The date is IBM’s initial bulletin publication on 2 October.
Sources
- Primary disclosurewww.ibm.com/support/pages/node/7290694
One record from the AI Risk Radar, maintained by the Security Desk.Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 13 October 2026