What is the CVSS score of CVE-2026-12946?

CVE-2026-12946 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of IBM Langflow are affected by CVE-2026-12946?

IBM Langflow OSS versions 1.0.0-1.10.0 contain a critical remote code execution vulnerability allowing any authenticated user to completely compromise the hosting server.. A patch is available.

How to fix or mitigate CVE-2026-12946?

Within 24 hours, inventory all IBM Langflow OSS deployments and identify systems running versions 1.0.0 through 1.10.0; restrict network access to affected systems and review authentication logs for suspicious activity. Within 7 days, apply the vendor-released security patch to upgrade all affected instances to the latest patched release per IBM's advisory. Within 30 days, audit user access controls across Langflow deployments, reset administrative credentials, perform forensic log analysis for signs of code injection or exploitation, and implement network segmentation to contain blast radius of future vulnerabilities.

IBM Langflow CVE-2026-12946

EUVD-2026-51273 CRITICAL

Code Injection (CWE-94)

2026-07-30 ibm

GHSA-mj9q-p4gc-9rw2

RCE IBM Code Injection Langflow Oss

9.9

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network-reachable app with low-privilege authenticated user (PR:L) able to inject code that escapes the app scope (S:C) for full host compromise; no user interaction and low complexity.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 19:52 vuln.today

CVE Published

Jul 30, 2026 - 19:01 cve.org

CRITICAL 9.9

DescriptionCVE.org

IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to inject arbitrary code on the system, due to the improper control of user input code.

AnalysisAI

Remote code injection in IBM Langflow OSS versions 1.0.0 through 1.10.0 allows an authenticated remote attacker to execute arbitrary code on the underlying host by supplying malicious user-controlled code that is improperly validated (CWE-94). Because Langflow evaluates user-supplied code as part of its low-code AI/agent flow-building functionality, exploitation grants full compromise of the server hosting the application. There is no public exploit identified at time of analysis, but the CVSS 3.1 base score of 9.9 with a scope change reflects that a successful attack can break out of the application context to affect other system components.

Technical ContextAI

IBM Langflow OSS is an open-source, low-code visual framework for building LLM-driven applications and agent workflows, where users compose 'flows' from components that can include custom Python code. The root cause is CWE-94 (Improper Control of Generation of Code / Code Injection): user-supplied input is passed into an execution context (such as a code component, template, or expression evaluator) without adequate sandboxing or input validation, so attacker-controlled strings are interpreted as executable code. The CPE cpe:2.3:a:ibm:langflow_oss:*:*:*:*:*:*:*:* identifies the affected application as IBM's Langflow OSS distribution across all listed sub-versions in the 1.0.0-1.10.0 range. The CVSS scope change (S:C) indicates the vulnerable component (the flow-execution engine) can impact resources beyond its own security authority - consistent with breaking out into the host OS.

RemediationAI

Patch available per vendor advisory - upgrade IBM Langflow OSS to the fixed release identified in IBM's advisory at https://www.ibm.com/support/pages/node/7278928 (consult that page for the exact fixed version, as a specific patched version string was not provided in the input data). Until patching is possible, reduce exposure by restricting network access to the Langflow web interface and API (place it behind a VPN or firewall so it is not internet-reachable), enforce strong authentication and remove or downgrade low-privilege accounts that do not require flow-building rights, and disable or restrict any custom-code / code-component features for untrusted users if the deployment supports that configuration - noting the trade-off that disabling code components limits legitimate low-code functionality. Monitor Langflow process activity for unexpected child processes as a detection compensating control.