Security1 hOctober 8, 2026, 11:20

Three Langflow flaws rated CVSS 9.8 allow unauthenticated RCE

IBM fixed three Langflow OSS vulnerabilities rated CVSS 9.8: CVE-2026-79724, CVE-2026-85025 and CVE-2026-81204. The Dutch NCSC says they can be exploited remotely without authentication or user interaction; the advisory lists 12 CVEs in total, including authorization flaws.

DEV Community

Open source

Three Langflow flaws rated CVSS 9.8 allow unauthenticated RCE

Three Langflow OSS flaws carry CVSS 9.8 scores
Exploitable remotely without authentication
Advisory NCSC-2026-0392 lists 12 CVEs total
ZoomEye found 18,550 Langflow instances on 23 September

#IBM#Langflow

IBM patches 12 flaws in MQ and Langflow OSS, three rated 9.8

Security

Langflow CVE-2026-0768 with CVSS 9.8 is under active exploitation

Security

CVE-2026-17633: Authenticated RCE in Langflow OSS via /api/v1/custom_component

Security

Three Langflow flaws rated CVSS 9.8 allow unauthenticated RCE

IBM patches 12 flaws in MQ and Langflow OSS, three rated 9.8

Langflow CVE-2026-0768 with CVSS 9.8 is under active exploitation

CVE-2026-17633: Authenticated RCE in Langflow OSS via /api/v1/custom_component

CVE-2026-69730: CVSS 9.8 RCE in Windows DNS Server in September Patch