CVE-2026-104339 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2026-104339 requires immediate attention.

· 7 min read

Executive Summary

CVE-2026-104339 is a critical remote code execution flaw in IBM Langflow OSS 1.0.0 through 1.12.3 caused by improper neutralization of special elements used in an OS command. In practical terms, a remote attacker may be able to make the application run arbitrary commands on the host. For solo developers and small teams, this is a high-priority issue because a single exposed service can become a full environment compromise.

Severity: Critical (CVSS 9.8)
KEV: No
Exploited in the wild: No

Even though there is no current evidence of active exploitation, the impact is severe enough that you should treat this as an urgent patch-and-verify event. If you run Langflow in a container, on a VM, or behind a reverse proxy, assume the attacker’s goal is to pivot from the app into your secrets, source code, CI tokens, and cloud credentials.

Immediate Action

  • Upgrade immediately to the first fixed release: 1.12.4+ (TODO: confirm exact patched version from vendor advisory).
  • Isolate the service until patched: restrict inbound access to trusted IPs, VPN, or localhost only.
  • Disable public exposure of Langflow UI/API if it is internet-facing; place it behind authentication and a firewall.
  • Rotate secrets that the service can access: API keys, environment variables, service tokens, and cloud credentials.
  • Rollback only if needed to a known-good, non-vulnerable build after patching is validated; do not remain on 1.12.3 or earlier.
  • Check the vendor advisory and release notes: IBM security advisory / Langflow release notes.

Affected Versions

  • ibm-langflow-oss@1.0.0 through 1.12.3 are vulnerable.
  • ibm-langflow-oss@1.12.4 and later are expected to be fixed (TODO: verify exact safe version).
  • If you deploy via container image tags, treat :1.12.3 and earlier as vulnerable; move to :1.12.4+ (TODO: confirm image tag mapping).

Resolution Guide

Python/pip:

pip install --upgrade "ibm-langflow-oss>=1.12.4"
# or, if installed in a virtualenv:
python -m pip install --upgrade "ibm-langflow-oss>=1.12.4"

pipx:

pipx upgrade ibm-langflow-oss

JavaScript/npm/yarn/pnpm: If your deployment wraps Langflow in a JS-based orchestrator or package, pin the fixed version explicitly.

npm install ibm-langflow-oss@1.12.4
yarn add ibm-langflow-oss@1.12.4
pnpm add ibm-langflow-oss@1.12.4

Java/Maven/Gradle: If you consume Langflow through a Java service wrapper or internal artifact mirror, update the dependency coordinate to the fixed version.

<dependency>
  <groupId>TODO.groupId</groupId>
  <artifactId>TODO.artifactId</artifactId>
  <version>1.12.4</version>
</dependency>
dependencies {
  implementation("TODO.groupId:TODO.artifactId:1.12.4")
}

Linux packages (apt/yum): If installed from a distro package, update from your repo or vendor channel.

sudo apt update
sudo apt install --only-upgrade ibm-langflow-oss

sudo yum update ibm-langflow-oss

Docker:

docker pull ibm/langflow-oss:1.12.4
docker stop langflow
docker rm langflow
docker run -d --name langflow -p 7860:7860 ibm/langflow-oss:1.12.4

Config hardening: Until patched, reduce attack surface by disabling any feature that accepts user-controlled input for shell or OS command execution, and remove unnecessary integrations.

# Example hardening ideas (adapt to your deployment)
LANGFLOW_ENABLE_SHELL_COMMANDS=false
LANGFLOW_DISABLE_UNTRUSTED_PLUGINS=true
LANGFLOW_ALLOWLISTED_ORIGINS=https://your-admin-host.example

Minimal code fix example: Never concatenate user input into shell commands. Use argument arrays and strict allowlists.

# BAD
os.system(f"convert {user_input}")

# BETTER
import subprocess
allowed = {"png", "jpg", "pdf"}
if user_input not in allowed:
    raise ValueError("invalid input")
subprocess.run(["convert", user_input], check=True)

Detection & Verification

Check installed version:

python -m pip show ibm-langflow-oss
pip freeze | grep -i langflow
docker image ls | grep -i langflow
docker inspect ibm/langflow-oss:1.12.3 --format '{{.RepoTags}}'

Check lockfiles and manifests:

grep -RniE "langflow|ibm-langflow-oss" requirements.txt pyproject.toml poetry.lock Pipfile* package.json package-lock.json yarn.lock pnpm-lock.yaml pom.xml build.gradle*

Look for risky command execution patterns in your own extensions or wrappers:

grep -RniE "os\.system|subprocess\.(run|call|Popen)|exec\(|shell=True|child_process\.exec|Runtime\.getRuntime\(\)\.exec" .

Verify the fix:

python -m pip install --upgrade "ibm-langflow-oss>=1.12.4"
python -m pip show ibm-langflow-oss | grep Version

docker run --rm ibm/langflow-oss:1.12.4 --version

After upgrading, restart the service and confirm the running container or process matches the fixed version. Re-test any input paths that previously reached OS command execution, and confirm they now reject or safely sanitize untrusted values.

Risk and Impact

If exploited, this vulnerability can give an attacker the ability to run commands as the Langflow process user, which may be enough to steal secrets, tamper with workflows, or deploy malware. In a small-team environment, that often means access to source code, API keys, CI/CD tokens, and connected cloud accounts.

The blast radius depends on how Langflow is deployed, but exposed internet-facing instances are the highest risk. If the service runs with broad filesystem access, mounted credentials, or privileged container settings, the impact can extend from a single app compromise to the entire host or surrounding infrastructure.

Keep reading