CVE-2026-90991: Langflow: unbounded resource allocation enables DoS

MEDIUM

Published October 29, 2026

CISO Take

IBM Langflow OSS versions 1.0.0 through 1.12.4 fail to limit or throttle resource allocation (CWE-770), so any authenticated user can send requests that exhaust server resources and take the service down. The CVSS score is 6.5 (medium) because the attack is network-based, low complexity, needs only a low-privilege account and has no confidentiality or integrity impact. There is no EPSS score, no public exploit, no Nuclei template and no CISA KEV listing, so exploitation is currently unlikely. Downstream dependents are unknown, so treat exposure as depending on whether your Langflow instances are multi-user or reachable from untrusted networks. Review the IBM advisory (ibm.com/support/pages/node/7293016) and upgrade past 1.12.4 to the fixed release. Until then, restrict access to trusted users and put rate limits and resource quotas in front of the service.

Sources:NVDIBM Security Bulletin (ibm.com)ATLAS

What is the risk?

Medium risk. The attack is network-reachable, low complexity and needs no user interaction, but it requires a valid low-privilege account and affects availability only (A:H, C:N, I:N). There is no known public exploit, scanner template or KEV listing, and no EPSS data is available. Risk is highest for shared or multi-tenant Langflow deployments, or any instance where untrusted users can register or hold accounts. Instances that orchestrate business-critical LLM workflows face the greatest operational impact.

How does the attack unfold?

Initial Access

Attacker authenticates to the Langflow instance with a low-privilege account.

AML.T0012

Exploitation

Attacker sends requests that trigger unbounded resource allocation with no throttling.

AML.T0049

Impact

Server resources are exhausted and the Langflow service stops responding, disrupting dependent AI workflows.

AML.T0029

Initial Access

Attacker authenticates to the Langflow instance with a low-privilege account.

AML.T0012

Exploitation

Attacker sends requests that trigger unbounded resource allocation with no throttling.

AML.T0049

Impact

Server resources are exhausted and the Langflow service stops responding, disrupting dependent AI workflows.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Langflow	pip	—	No patch
156.0KPushed 6d ago18% patched~66d to patchFull package profile →

Do you use Langflow? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 33% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CNone

INone

AHigh

What should I do?

5 steps

Upgrade IBM Langflow OSS to a release newer than 1.12.4, as directed in the IBM advisory (https://www.ibm.com/support/pages/node/7293016).
Until patched, limit Langflow access to trusted users, disable open self-registration and put the service behind a VPN or an authenticating reverse proxy.
Apply per-user and per-IP rate limiting and request size limits at the proxy or WAF.
Set container or process limits on CPU, memory and concurrency (for example Docker or Kubernetes quotas) so one request cannot take down the host.
Monitor for abnormal resource spikes, repeated heavy requests from a single account and unexpected restarts or OOM kills, and alert on them.

How is it classified?

DoSFrameworkAPIAML.T0012- Valid Accounts AML.T0029- Denial of AI Service AML.T0034- Cost Harvesting

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Respond to and recover from AI risks and unexpected events

OWASP LLM Top 10

LLM10-Unbounded Consumption

Frequently Asked Questions

What is CVE-2026-90991?

Is CVE-2026-90991 actively exploited?

No confirmed active exploitation of CVE-2026-90991 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-90991?

1. Upgrade IBM Langflow OSS to a release newer than 1.12.4, as directed in the IBM advisory (https://www.ibm.com/support/pages/node/7293016). 2. Until patched, limit Langflow access to trusted users, disable open self-registration and put the service behind a VPN or an authenticating reverse proxy. 3. Apply per-user and per-IP rate limiting and request size limits at the proxy or WAF. 4. Set container or process limits on CPU, memory and concurrency (for example Docker or Kubernetes quotas) so one request cannot take down the host. 5. Monitor for abnormal resource spikes, repeated heavy requests from a single account and unexpected restarts or OOM kills, and alert on them.

What systems are affected by CVE-2026-90991?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, LLM workflow orchestration, RAG pipelines, model serving.

What is the CVSS score for CVE-2026-90991?

CVE-2026-90991 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.39%.

What is the AI security impact?

Affected AI Architectures

agent frameworksLLM workflow orchestrationRAG pipelinesmodel serving

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0029Denial of AI Service

AML.T0034Cost Harvesting

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM10

What are the technical details?

Original Advisory

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to cause a denial of service due to allocation of resources without limits or throttling.

Exploitation Scenario

An attacker obtains or already holds a low-privilege Langflow account, for example through open registration or a compromised user. They send a stream of requests, or a few crafted ones, that make the server allocate large amounts of memory or compute with no throttling. Server resources run out and the Langflow API and UI stop responding. Production flows, chatbots and agents built on the instance go offline until the service is restarted and the abusive account is blocked.

Weaknesses (CWE)

CWE-770Allocation of Resources Without Limits or ThrottlingPrimary CWE-770Allocation of Resources Without Limits or Throttling

CWE-770 — Allocation of Resources Without Limits or Throttling: The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

[Requirements] Clearly specify the minimum and maximum expectations for capabilities, and dictate which behaviors are acceptable when resource allocation reaches limits.
[Architecture and Design] Limit the amount of resources that are accessible to unprivileged users. Set per-user limits for resources. Allow the system administrator to define these limits. Be careful to avoid CWE-410.

Source: MITRE CWE corpus.