CVE-2026-93447: CWE-502 Deserialization of Untrusted Data in IBM Langflow OSS

CVE-2026-93447 describes a deserialization of untrusted data vulnerability in IBM Langflow OSS versions 1.0.0 through 1.12.2. An attacker who has access to the server secret and write permissions on Redis can submit a malicious serialized cache value. When the application retrieves and deserializes this value, it may execute attacker-controlled code with the privileges of the service process, potentially leading to full compromise of the service.

Successful exploitation can result in arbitrary code execution with the privileges of the Langflow OSS service process, potentially leading to full system compromise, data theft, or service disruption. The vulnerability requires the attacker to have both the server secret and Redis write access, which limits the attack surface but remains a serious risk if these conditions are met.

No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the IBM vendor advisory for current remediation guidance. Until a fix is available, restrict access to the server secret and Redis write permissions to trusted users only to reduce the risk of exploitation.