CVE-2026-18894

Langflow public workflows can run pre-existing stored Python components

IBM / Langflow · Langflow OSS

First documented disclosure · Review checkpoint

Summary

Execution of those stored components in the owner’s context, with limited confidentiality and integrity impact scored by IBM.

Severity and exploitation evidence

Medium · 6.5/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed primary records do not establish malicious exploitation or a confirmed victim.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Public execution can invoke stored Python components under the flow owner’s runtime instead of remaining limited to trusted server code.

Conditions required

A reachable public workflow already contains stored Python component code. This is not proof that an anonymous caller can upload arbitrary new code.

Potential impact

Execution of those stored components in the owner’s context, with limited confidentiality and integrity impact scored by IBM.

Affected versions and configurations

IBM lists Langflow OSS 1.0.0 through 1.12.4. This broad range conflicts with IBM’s issue-specific earlier-fix statement.

Fix and mitigation status

IBM says this issue was fixed in 1.11.2; 1.12.5 includes it. Its broad affected-version table still extends through 1.12.4.

Practical next steps

Upgrade to a current supported release containing the fix; back up the deployment and validate workflow behavior. Where MCP stdio is used, IBM additionally requires interpreter hardening and administrator-only controls; configuration changes do not replace upgrading. Keep LANGFLOW_ALLOW_PUBLIC_CUSTOM_COMPONENTS disabled; enabling it deliberately permits custom component execution.

Operating lesson

Keep public workflows limited to explicitly trusted execution capabilities.

Evidence and limits

IBM bulletin 7293016 was initially published 2026-10-19; the CNA record followed on 2026-10-29. Earlier upstream patches are not assigned to this CVE by inference. Exact technical details absent from the public record remain unknown; a CVSS score is not an observed incident. The affected-range/earlier-fix inconsistency is preserved rather than silently reconciled.

Sources