Deserialization Vulnerability in IBM Langflow OSS Affects Multiple Versions

CVE-2026-93447

What is CVE-2026-93447?

A deserialization vulnerability exists in IBM Langflow OSS versions 1.0.0 through 1.12.2, where an attacker with access to the server secret and Redis write permissions can exploit this flaw. By submitting a malicious serialized cache value, the attacker can execute code under the service's privileges upon retrieval of the value, posing a significant security risk.

References