Langflow 1.12.3 Closed 25 Holes. Your Canvas Still Executes

Do Son at SecurityOnline wrote it up on October 6. IBM’s bulletin covers 25 vulnerabilities in Langflow OSS. Versions 1.0.0 through 1.12.2. Two of them, CVE-2026-104334 and CVE-2026-93674, are scored 9.8 on CVSS 3.1 and described as unauthenticated remote code execution. The fix is 1.12.3. IBM lists no workarounds.

That is an automation story because Langflow is how a lot of teams draw Python instead of scheduling it. We already had CVE-2026-0768 in the wild in September, stealing keys off boxes. Different CVE. Same class of process: a canvas that can run code, sitting on a port, with model secrets in the environment. The low-code AI workflow roundup is still the shopping list. This week is the patch train. The generic version lives in Python security practice.

IBM’s page is the primary

The IBM Security Bulletin (node 7290694, initial publication October 2) is what the October write-ups are paraphrasing. Affected product: Langflow OSS 1.0.0–1.12.2. Remediation: upgrade to 1.12.3. Workarounds and mitigations: none.

The bulletin body, as extracted, names several of the 25. CVE-2026-97673: a remote authenticated attacker can execute arbitrary code because of improper input validation, CVSS 8.8, CWE-693. CVE-2026-97655: a remote attacker can execute arbitrary code because the code security scanner’s blocklist is incomplete, CVSS 8.8, CWE-94. CVE-2026-93449: remote authenticated code generation control failure, CVSS 8.5, CWE-94. CVE-2026-93675: remote attacker via expected dependency confusion, CVSS 8.8, CWE-440. A deserialization issue sits at CVSS 7.5, CWE-502.

Authenticated versus unauthenticated matters. SecurityOnline’s two 9.8s are the unauthenticated pair. The 8.8s still assume someone can talk to the service. If you bound Langflow to 0.0.0.0 and called it a demo, you offered both classes to the internet.

IBM’s “no workaround” line is the one operators skip. There is no “disable the playground” footnote in the extract. Upgrade or live with the CVEs.

What GBHackers added on the calendar

GBHackers, with a page date of October 11, reprints a table. CVE-2026-104334, 9.8, CWE-94, unauthenticated code injection. CVE-2026-97677, 8.1, CWE-22, arbitrary file access. CVE-2026-97676, 8.8, sandbox escape. CVE-2026-97655, 8.8, scanner blocklist bypass. CVE-2026-97674, 8.1, OS command execution. CVE-2026-103360, 8.1, path traversal. Cache bugs: CVE-2026-97680 access control, CVE-2026-93447 deserialization if you have the server secret and Redis write.

SecurityOnline’s file-access paragraph matches 97677: a flow author can write files into any directory the service account can write, and can read configuration, secrets, or database files. CVE-2026-93679 crashes the server with oversized ZIP archives. Credential leaks and vertex-cache poisoning sit in the same roundup.

GBHackers also dates the patches. IBM published 1.12.3 on September 22, 2026, and 1.12.4 on September 29. If you “upgraded in September” to 1.12.2, you did not. If you are on 1.12.4, ask your image mirror whether that tag is real or a local lie.

The September 22 fix date versus the October 6 write-up is the usual lag. Bots do not wait for GBHackers.

CVE-2026-93674 is the inspection primitive

Penligent’s October 12 note zooms in on 93674. Affected 1.0.0–1.12.2, fixed in 1.12.3, CVSS 9.8. Public analysis, as they summarize it: a code-validation path where importing a Python module could execute during what was supposed to be inspection. The CVSS vector they cite requires no prior privileges. They mention a public reproduction that got RCE without credentials in a configuration that used automatic login. Actual exposure, they add, depends on auth settings and whether the service is reachable.

That last sentence is the only mercy. A Langflow that is not on a network cannot be hit from a network. Most of the ones that get written up are on a network. Auto-login is a feature until it is a CVE footnote.

Penligent’s ops warning is the one I would tape to a monitor: a dev venv can show 1.12.3 while the production container still boots 1.12.1. pip show langflow on your laptop is not docker exec. Check the running image. Check the lockfile. Check the helm values. Then check them again on the box that has the OpenAI key.

September’s 0768 was theft of environment variables after code execution. This week’s list is how many doors still lead to execution: scanner blocklist, dependency confusion, deserialization, “inspect this module.” You can patch 0768 and still be open on 104334. That is why IBM shipped a bulletin instead of a single CVE blog post.

The canvas is an interpreter

Langflow is a Python process that builds graphs people think of as documents. Custom components, playgrounds, and “validate this code” buttons are exec with a UI. A blocklist in the scanner (CVE-2026-97655) is an admission that the product tries to let some code through. Incomplete blocklists are how that design fails.

If your automation stack is cron plus httpx, you do not need Langflow on the public internet to get an LLM into a workflow. If your stack is a shared Langflow and a dozen intern graphs, you are running other people’s Python as the service user. CVE-2026-97677’s “any directory writable by the service account” is what that user can already do, documented as a CVE.

Mitigations that are not in IBM’s workaround field but are still free:

• Do not publish Langflow on 0.0.0.0
• Do not use auto-login on anything that can see production secrets
• Do not run the process as root
• Do not keep AWS_SECRET_ACCESS_KEY in the same env as the UI
• Put 1.12.3 or later in the image, not in a README

None of those replace 1.12.3. They make the next bulletin less of a page-out.

Dependency confusion and Redis are not theoretical

CVE-2026-93675 in IBM’s bulletin is “expected dependency confusion,” CVSS 8.8. If Langflow installs or imports user-influenced package names, a public index can win the race. Pin hashes. Disable surprise installs from the UI. If the product has a “install this component’s requirements” button, that button is in scope.

CVE-2026-93447, as GBHackers describes it, needs the server secret and Redis write to turn a cached blob into code in the service process. That is a two-lock bug. People leave both locks in the same docker-compose file. Rotate the secret. Do not expose Redis. If Redis is on the public subnet “temporarily,” you have already combined the locks.

Path traversal and arbitrary file write (97677, 103360) mean a flow author is an OS user. Treat flow-edit permission like deploy permission. Interns who can drag nodes can write files as the service account. That is not a future IBM bulletin. It is in this one.

ZIP bombs (93679) are the denial-of-service sibling. If your Langflow accepts uploads, cap size at the reverse proxy. IBM did not list that as a workaround. It is still a filter you should have had.

Scanner blocklist bypass (97655) is the design smell. A scanner that permits some dynamic Python will miss some dynamic Python. After you patch, assume custom components are still code review, not a GUI.

Patch order for a Python shop this week

1. Find every Langflow. ps, compose files, k8s, that one EC2 someone launched in March.
2. Record the version from inside the container, not from the chart comment.
3. If it is 1.12.2 or older, schedule 1.12.3 or 1.12.4. IBM’s words: address it now.
4. Rotate every secret that lived in that process environment. September 0768 already taught this. Do it anyway.
5. If you cannot patch today, unplug the port. IBM said there is no workaround. Unplugging is not a workaround. It is turning the machine off.
6. Add langflow to the same Dependabot/OSV file you use for FastAPI. A canvas is a dependency.

If you never installed Langflow, this bulletin is still a design review. Any Python tool that inspects user-supplied code on a server has this shape. Prefect, Dagster, and homegrown Streamlit apps grow the same button. The CVE numbers will differ. The exec will not.

SecurityOnline’s reason-it-matters paragraph is correct and unfashionable: these servers hold API keys and database passwords. A takeover is not “they got our toy agent.” It is they got the token the agent was using to talk to production.

1.12.3 is a version pin. Put it in the lockfile. Then go look at whether the canvas still needs to be a network service at all.

If you inherited a Langflow from a hackathon, the honest retirement path is: export the graphs you still need, rewrite the two that matter as a FastAPI job or a cron, delete the container. A bulletin with 25 rows is a sign the product surface is larger than your use. You do not owe a low-code UI a production lifespan.

For teams that will keep it, write the version in three places: the image tag, the Compose/Helm values, and a Slack bookmark titled langflow prod version. When 1.12.5 lands, you should not have to grep the company. GBHackers’ September 22 / September 29 dates are the reminder that IBM can ship a follow-up in a week. Subscribe to the bulletin page instead of waiting for another October roundup.

Penligent’s table that lists 1.12.3 as the fixed line is the one to paste into the ticket. Do not paste CVE-2026-0768 from September into the same ticket unless you are writing a postmortem that covers both. Different identifiers. Same box, maybe. Different patch notes, definitely.

The last check is stupid and it catches people: hit the UI, open About, read the number. If About says 1.12.2 after you “rolled 1.12.3,” you rolled a laptop. Go back to step 2.

Do not open the playground on a patched box and paste untrusted components “to see if the scanner works.” IBM’s 97655 is the scanner failing as a security boundary. Your curiosity is a test in production. If you need to verify the patch, check the version string and the changelog, then keep the port off the internet.

For CI: pin langflow==1.12.3 or the 1.12.4 tag GBHackers dated September 29, rebuild the image, fail the pipeline if pip show disagrees. That is the whole automation. The canvas can wait until the pin is real.

If About is hidden behind a login you disabled, python -c "import langflow,sys; print(langflow.__version__)" inside the same image is the fallback. Version strings are boring. Boring is the patch.