What is the CVSS score and severity of CVE-2026-110186?

CVE-2026-110186 is rated CRITICAL with a CVSS score of 9.8 (CVSS 3.1, IBM) (Network; unauthenticated (AV:N/AC:L/PR:N/UI:N)) and is classified under CWE-94 (Improper Control of Generation of Code ('Code Injection')).

CVE-2026-110186 CRITICAL · CVSS 9.8 (CVSS 3.1, IBM) · IBM / Langflow — Langflow OSS · 2026-10-29

CVE-2026-110186: Code generation service (reachable through MCP tool enumeration)

Q: What versions are affected by CVE-2026-110186?

CVE-2026-110186 affects Langflow OSS 1.0.0 through 1.12.8 in Langflow OSS (Code generation service (reachable through MCP tool enumeration)).

Q: How do I patch or remediate CVE-2026-110186?

To remediate CVE-2026-110186, upgrade to the patched release: Langflow OSS 1.13.0. Upgrade to Langflow OSS 1.13.0 or later (pip or the langflowai/langflow:1.13.0 image); IBM lists no workarounds. Back up the database, secret key, and uploaded files before upgrading. Remove public internet exposure and rotate API keys stored in flows if the instance was reachable.

Langflow OSS could allow a remote, unauthenticated attacker to execute arbitrary code due to improper control of code generation. IBM says the flaw is exploitable through model context protocol (MCP) tool enumeration. It was disclosed alongside an auto-login authentication bypass and several authenticated code execution bugs.

Identifier

CVE-2026-110186

Vendor / Product

IBM / Langflow · Langflow OSS

Severity / CVSS

CRITICAL · CVSS 9.8 (CVSS 3.1, IBM)

Vector / CWE

CWE-94 (Improper Control of Generation of Code ('Code Injection'))

Network; unauthenticated (AV:N/AC:L/PR:N/UI:N)

Affected

Langflow OSS 1.0.0 through 1.12.8

Patched Version

Langflow OSS 1.13.0

Priority

P0 — Patch Internet-Facing Langflow Immediately

Executive Summary & Technical Impact

Tracked under CVE-2026-110186 (CWE-94 (Improper Control of Generation of Code ('Code Injection'))), this vulnerability affects Langflow OSS 1.0.0 through 1.12.8 and carries a severity score of 9.8 (CVSS 3.1, IBM) (CRITICAL). Engineering and security operations teams running Langflow OSS should prioritize upgrading to Langflow OSS 1.13.0.

Remediation & Patch Guidance

Upgrade to Langflow OSS 1.13.0 or later (pip or the langflowai/langflow:1.13.0 image); IBM lists no workarounds.
Back up the database, secret key, and uploaded files before upgrading.
Remove public internet exposure and rotate API keys stored in flows if the instance was reachable.

Frequently Asked Questions (CVE-2026-110186)

What versions are affected by CVE-2026-110186?

CVE-2026-110186 affects Langflow OSS 1.0.0 through 1.12.8 in Langflow OSS (Code generation service (reachable through MCP tool enumeration)).

How do I patch or remediate CVE-2026-110186?

Upgrade affected deployments to Langflow OSS 1.13.0 and verify the remediation steps listed above.

What is the CVSS score of CVE-2026-110186?

CVE-2026-110186 is rated CRITICAL with a CVSS score of 9.8 (CVSS 3.1, IBM) (vector: Network; unauthenticated (AV:N/AC:L/PR:N/UI:N)).

Full TechPulse Investigation

Your AI Dev Tools Are the New Attack Surface: npm 'open' PowerShell Injection (CVE-2026-119025), Langflow RCE, and Broken Built-In Browsers

A malicious MCP server can run code on Windows the moment you connect, Langflow OSS ships 9.8-rated unauthenticated RCE fixes, and new EMBRACE research shows coding-assistant browsers reading local files.

Read full engineering post-mortem (6 min read) →