CVE-2026-110186 is a critical (CVSS 9.8) code injection flaw in IBM Langflow OSS versions 1.0.0 through 1.12.8 that could let a remote attacker execute arbitrary code.
What Is It
CVE-2026-110186 is a code injection vulnerability in IBM Langflow OSS, classified as CWE-94 (Improper Control of Generation of Code). The NVD record says the product "could allow a remote attacker to execute arbitrary code due to improper control of code generation."
IBM's PSIRT ([email protected]) published the record on 2026-10-29. Its NVD status is currently "Undergoing Analysis," so NVD has not yet finished its own enrichment.
Why It Matters
IBM's CVSS v3.1 score is 9.8 (CRITICAL), with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. In plain terms:
- Attack vector: Network. It can be exploited remotely.
- Attack complexity: Low.
- Privileges required: None. No authentication is needed.
- User interaction: None.
- Impact: High loss of confidentiality, integrity, and availability.
Together, these ratings describe a remote code execution bug that needs no login and no user action. That makes any reachable Langflow OSS instance a high-priority target.
Exploitation status: No CISA KEV entry was supplied for this CVE. Active exploitation has not been confirmed by KEV as of this writing. Because the flaw requires no authentication, defenders should not wait for a KEV listing before acting.
What's Vulnerable
- Vendor: IBM
- Product: Langflow OSS
- Affected versions: 1.0.0 through 1.12.8 inclusive (semver)
- CPEs listed:
cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*cpe:2.3:a:ibm:langflow_oss:1.12.8:*:*:*:*:*:*:*
Patch Status
The supplied NVD record does not name a fixed version. It also contains no remediation guidance, and there is no CISA KEV required action or due date because there is no KEV entry. IBM's security bulletin is the authoritative source for fix and mitigation details. Organizations running Langflow OSS 1.0.0–1.12.8 should:
- Check that bulletin for an updated release or workaround.
- Find every deployed instance.
- Limit network exposure of those instances until a patch is applied.
Sources
- NVD, CVE-2026-110186
- IBM Security Bulletin (node 7294467)
- CISA Known Exploited Vulnerabilities Catalog (no entry supplied for this CVE)