CVE-2026-110186(langflow / langflow)

🔴 IBM Langflow OSS: Langflow OSS is affected by multiple vulnerabilities (CVE-2026-110186) IBM Langflow OSS software is affected by this vulnerability. Patch → see advisory https://cve.now/CVE-2026-110186

IBM Langflow に未認証でリモートコード実行できる CVE-2026-110186（CVSS 9.8）。1.13.0 で修正されています。KEV には未収載ですが、外部公開している Langflow は更新を急ぎたいところです。 https://cve.autoarticles.net/cve/CVE-2026-110186

#NØØT_Security_Alerts 🚨 #ALERT — Critical Remote Code Execution Vulnerability in Langflow OSS October 28, 2026 PRODUCT: Langflow OSS. CVE: CVE-2026-110186. SEVERITY: CRITICAL — CVSS 9.8. AFFECTED VERSIONS: Langflow OSS 1.0.0 through 1.12.8. IMPACT: Improper control of code generation may allow an unauthenticated remote attacker to execute arbitrary code on the server. IBM’s bulletin also identifies an unauthenticated code-execution exposure involving MCP tool enumeration. EXPLOITATION STATUS: Vendor-confirmed technical vulnerability. No independently verified attacks in the wild. FORENSIC TRIAGE: Investigate unexpected MCP requests, untrusted tool enumeration, suspicious component execution and abnormal server processes. URGENT ACTION: Upgrade to Langflow OSS 1.13.0. Restrict access to exposed MCP interfaces during remediation and review execution logs for anomalies. SOURCE: https://www.ibm.com/support/pages/security-bulletin-langflow-oss-affected-multiple-vulnerabilities-2 CONFIDENCE: HIGH — Original IBM bulletin and confirmed fixed release. Initial publication October 28; clarification October 29. #Langflow #MCP #AISecurity #RCE #CVE #ThreatIntelligence #AppSec