PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-93675 IBM CVE debrief

IBM Langflow OSS versions 1.0.0 through 1.12.2 are vulnerable to a dependency confusion issue, potentially allowing remote attackers to execute arbitrary code. This high-severity vulnerability requires immediate attention from defenders, who should verify exposure, prioritize patching, and monitor for exploitation attempts. The CVE record and source item provide information on the vulnerability, but details on exploitation and impact are limited. Defenders should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Vendor
IBM
Product
Langflow OSS
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-07
Original CVE updated
2026-10-07
Advisory published
2026-10-07
Advisory updated
2026-10-07

Who should care

Defenders responsible for Langflow OSS deployments, security teams, and IT administrators should assess exposure and prioritize patching. They should also review compensating controls for exposed systems while remediation is scheduled and verified. Additionally, defenders should monitor for potential exploitation attempts and review relevant monitoring, detection, and logs for exposed assets that need extra review.

Why it matters

CVE-2026-93675 is a high-severity vulnerability in Langflow OSS, potentially allowing remote code execution. Defenders should verify exposure, prioritize patching, and monitor for exploitation attempts.

  • Potential code execution requires verification from official sources
  • Need to verify Langflow OSS version and apply patches
  • Inventory checks and monitoring for exploitation attempts are necessary

Technical summary

IBM Langflow OSS versions 1.0.0 through 1.12.2 are vulnerable to dependency confusion due to an expected dependency. This vulnerability could allow remote attackers to execute arbitrary code. The vulnerability has a CVSS score of 8.8, indicating high severity. Defenders should prioritize verifying the Langflow OSS version and applying patches to prevent potential code execution.

Defensive priority

Defenders should prioritize verifying the Langflow OSS version and applying patches to prevent potential code execution.

Recommended defensive actions

  • Verify Langflow OSS version and apply patches
  • Review and update inventory of Langflow OSS deployments
  • Monitor for potential exploitation attempts

Evidence notes

The CVE record and source item provide information on the vulnerability, but details on exploitation and impact are limited. Defenders should verify Langflow OSS version and apply patches. The vulnerability has a high CVSS score of 8.8, indicating a high severity. There is no information on known or unknown affected scope. Defenders should review compensating controls for exposed systems while remediation is scheduled and verified.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-93675 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-93675

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-93675 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-93675

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Langflow OSS is affected by multiple vulnerabilities

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/93xxx/CVE-2026-93675.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://www.ibm.com/support/pages/node/7290694

    Supplemental source - vendor-advisory, patch

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.