First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-103092

HighCVSS 8.8/10Last modified Oct 30, 2026

Description

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper access control.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
IBM	Langflow OSS	>= 1.0.0, <= 1.12.3

References

https://www.ibm.com/support/pages/node/7293015Patch, Vendor Advisory

Timeline

Published: Oct 29, 2026
Last modified: Oct 30, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1030939.4ServiceNow has remediated a sandbox escape security issue that was identified in the ServiceNow AI Platform. This vulnerability could enable CVE-2026-1030947.1ServiceNow has remediated an information disclosure vulnerability that was identified in the ServiceNow AI Platform. This vulnerability coul CVE-2026-1030967.5API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive CVE-2026-1030977.5An API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensit CVE-2026-1030987.5Transmission of a sensitive key in the URL over an unencrypted HTTP connection. The request is sent over HTTP rather than HTTPS, meaning th CVE-2026-1030997.5Pexip Infinity before 41.1 is affected by improper input validation in the media implementation that allows a remote attacker to trigger a s CVE-2026-10316.1IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site scripting. T CVE-2026-1031007.5Pexip Infinity before 40.1 is affected by improper input validation in the signaling implementation that allows a malicious attacker to trig CVE-2026-1031017.5Pexip Infinity 30.0 through 40.x before 41.0 is affected by improper input validation in the web server that allows a malicious attacker to CVE-2026-1031028.6Pexip Infinity before 41.0 is affected by improper input validation in the signaling implementation which allows a remote attacker to trigge CVE-2026-1031047.5Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation in the media implementation which allows a re CVE-2026-1031058.8Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper access control on a product-internal API which allows an attac

CVE-2026-103092: High severity, CVSS 8.8 | Vulnix