takenaka hiroya@Joe_Biden_ja
Langflow 1.0.0〜1.12.3 に、受け取ったデータを検証せず復元してしまい任意コード実行に至る脆弱性 CVE-2026-104317（CVSS 9.8）。1.12.4 で修正されています。何が起きるのかと影響範囲をまとめました。 https://ai-news.autoarticles.net/article/post_1793501255767_efr31g
0000046
557 followersView on X
CVE-2026-104317(langflow / langflow)
LOWCVSS 9.8 · CRITICALSignal is active with 2 mentions in latest observed window
Immediate actions
- Track advisory updates for patch or workaround availability
Recommended action window: Monitor and triage in normal cycle
NVD description
IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker who could reach the message broker to execute arbitrary code on the system due to the deserialization of untrusted data.
0.0/ 10 priority
Sources & remediation
Weakness type (CWE)
CWE-502
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
Are you affected?
If you run products in this scope, you should treat this CVE as relevant to your environment.
- langflow
Threat summary
- 2 mentions across 1 observed day
What's happening
- 2 total mentions across 1 day
Affected systems
Vendors
Products
langflow
Deep dive
Activity timeline2 mentions / 1d
Referenced assets2 URLs
Full discourse2 posts
- takenaka hiroya@Joe_Biden_ja
IBM Langflow がメッセージブローカー経由のデータを検証せずに復元し、コード実行に至る CVE-2026-104317。NVD は 9.8、IBM は 8.1 と評価が分かれています。1.12.4 で修正ですが、ほかの掲載 CVE も考えると 1.13.0 以上を。 https://cve.autoarticles.net/cve/CVE-2026-104317
0000043557 followersView on X
CPE platform detail1 entries
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | langflow | langflow | - | - | - |