CVE-2026-93675: IBM Langflow OSS Dependency Confusion RCE

CVE-2026-93675 is a dependency-confusion vulnerability in IBM Langflow OSS, the open-source visual builder for LLM/agent workflows, where the application's own package-resolution behavior can be tricked into fetching and running an attacker-published package instead of the intended one, giving a remote attacker code execution on the Langflow server — a textbook software-supply-chain attack rather than a classic memory-safety or injection bug.

CVE-2026-93675 (CWE-440, Expected Behavior Violation) affects Langflow OSS, an open-source tool for visually building LLM and agent workflows (also distributed and supported as part of IBM's offerings). NVD's description is terse: "IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to an expected dependency confusion" (NVD).

Dependency confusion is a software-supply-chain attack class where an application resolves a package name against a public registry (e.g. PyPI) when it should only ever resolve that name against a private/internal source, or vice versa resolves ambiguously; an attacker who publishes a same-named package to the registry the resolver actually checks can get their code pulled in and executed. NVD's own analysis gives it a Primary CVSS v3.1 base score of 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable, low complexity, no privileges required, and notably no user interaction required in NVD's own scoring. IBM's own CNA submission scores it lower, CVSS v3.1 8.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H — the vendor's submitted score requires user interaction (UI:R) where NVD's Primary re-analysis does not (NVD).

IBM's own security bulletin for Langflow OSS, published 2026-10-02, lists CVE-2026-93675 among several Langflow OSS CVEs patched together, with the identical CWE-440 classification, IBM's own CVSS vector, and the affected range given as "Langflow OSS 1.0.0-1.12.2." The bulletin's remediation section states: "IBM strongly recommends addressing the vulnerability now by upgrading Langflow OSS to version 1.12.3," and records no available workaround or mitigation short of upgrading (IBM Security Bulletin, Document ID ibm17290694).

As of 2026-10-30, FIRST scores the probability of exploitation at 0.00625 (49.9th percentile) — moderate relative to this batch, consistent with a supply-chain-class bug that requires an attacker to first get their package positioned ahead of the legitimate one rather than simply reaching an open network port (FIRST EPSS). CVE-2026-93675 is not currently listed in the CISA Known Exploited Vulnerabilities catalog (checked against the live KEV feed, catalog version 2026.10.30, 1766 entries).

Any deployment running Langflow OSS 1.0.0 through 1.12.2 — whether self-hosted directly or via an IBM-supported distribution — should upgrade to 1.12.3 or later; because the root cause is in how the application resolves its own package dependencies rather than in a specific user-facing endpoint, there is no documented workaround short of the version upgrade.

• IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to an "expected dependency confusion" (CWE-440). — NVD
• NVD Primary CVSS v3.1 base score is 9.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (no user interaction required); IBM's own CNA submission scores it 8.8 with UI:R (user interaction required), a materially different exploitation model for the same CVE. — NVD
• IBM Security Bulletin (ibm17290694, published 2026-10-02) confirms CVE-2026-93675, CWE-440, affected range Langflow OSS 1.0.0-1.12.2, and states IBM strongly recommends upgrading to 1.12.3 with no other workaround. — IBM Security Bulletin
• EPSS score is 0.00625 (49.9th percentile) as of 2026-10-30; not present in the live CISA KEV feed (catalog version 2026.10.30, 1766 entries) checked by exact cveID match. — FIRST EPSS