Type Vulnerability
This release adds multiple new modules, and 6 of those modules point at a single target: Langflow, the open-source LLM workflow builder.
Grafana
The SQL Expressions experimental feature of Grafana allows for the evaluation of queries containing user input
CVE-2026-93674
What this means
This is rated critical severity (9.8 out of 10). Current estimates put the chance of attack in the next 30 days at roughly 15%. Ask IT whether Langflow Langflow is in your estate, and treat that as the priority.
Full vendor description
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.
Scoring and exploitation
9.8/ 10
CVSS 3.1 base scoreCritical
Exploitable over the network without any account, and no one has to click or open anything. High impact on confidentiality, integrity and availability.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability
Longer bar: easier to attack
Attack vectorNetworkAV:N
Attack complexityLowAC:L
Privileges requiredNonePR:N
User interactionNoneUI:N
ScopeUnchangedS:U
Impact
Longer bar: more harm
ConfidentialityHighC:H
IntegrityHighI:H
AvailabilityHighA:H
- Elevated attack likelihood (~15.3% in 30 days)Model estimate (): a probability signal, not confirmed exploitation
- Exploited in the wild
- Not confirmed in the
- Not reported
Weaknesses
CWE-94
Affected products ()
- Langflow Langflow
Show the raw CPE strings (1)
- cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*
References
1 link from the CVE record, grouped by site; the vendor's advisory comes first.
ibm.com1 linkVendor advisory
- 7290694 (opens in a new tab)Vendor Advisory