Langflow Oss IBM Langflow Oss

  1. Vendors
  2. IBM
  3. Langflow Oss

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in IBM Langflow Oss.

By the Year

In 2026 there have been 117 vulnerabilities in IBM Langflow Oss with an average score of 8.0 out of ten.

Year Vulnerabilities Average Score
2026 117 8.01

It may take a day or so for new Langflow Oss vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent IBM Langflow Oss Security Vulnerabilities

IBM Langflow OSS 1.0.0-1.10.0 Arbitrary Python Code Exec via Component Imports
CVE-2026-12944 9.6 - Critical - September 14, 2026

IBM Langflow OSS 1.0.0 through 1.10.0 can allow attackers to execute arbitrary Python code with root privileges (UID=0) on the Langflow server by submitting components containing socket or urllib imports. This enables: (1) AWS credential theft via IMDSv1 SSRF with full IAM role permissions, (2) arbitrary file exfiltration from the container filesystem, and (3) lateral movement to internal services (PostgreSQL, Redis) within the Docker network. The scanner incorrectly returns "validated": true, providing a false security signal.

SSRF

IBM Langflow OSS 1.0.0 through 1.11.5 could
CVE-2026-12763 4.2 - Medium - September 14, 2026

IBM Langflow OSS 1.0.0 through 1.11.5 could allow an authenticated attacker to access another user's MCP server context due to improper cache key isolation in the MCP Tools component.

Missing Authentication for Critical Function

IBM Langflow OSS 1.0.0 through 1.10.2 is vulnerable to server-side request forgery (SSRF)
CVE-2026-12765 6.5 - Medium - September 14, 2026

IBM Langflow OSS 1.0.0 through 1.10.2 is vulnerable to server-side request forgery (SSRF). This may allow an unauthenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

SSRF

IBM Langflow OSS 1.0.0 through 1.11.2 is vulnerable to server-side request forgery (SSRF)
CVE-2026-12766 5.4 - Medium - September 14, 2026

IBM Langflow OSS 1.0.0 through 1.11.2 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

SSRF

IBM Langflow OSS 1.0.0 through 1.11.5 is vulnerable to server-side request forgery (SSRF)
CVE-2026-12767 6.5 - Medium - September 14, 2026

IBM Langflow OSS 1.0.0 through 1.11.5 is vulnerable to server-side request forgery (SSRF). This may allow an unauthenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

SSRF

IBM Langflow OSS 1.0.0 through 1.10.2 could
CVE-2026-17628 5.4 - Medium - September 14, 2026

IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to change the password of an account due to improper authentication.

authentification

IBM Langflow OSS 1.0.0-1.11.5 Arbitrary OS Exec via Custom Comp Injection
CVE-2026-76059 8.8 - High - September 10, 2026

IBM Langflow OSS 1.0.0 through 1.11.5 An attacker who could submit custom component source code could bypass the static security scanner by crafting an annotated class-body assignment that resolved to a dangerous callable through alias tracking; the resolved value was never checked against the dangerous callable blocklist due to the logic error. If the crafted component reached the runtime execution path, the attacker could cause arbitrary operating system commands to execute on the server in-process, with the privileges of the running service.

Protection Mechanism Failure

IBM Langflow OSS 1.0.0-1.11.5 Auth RCE via Denylist
CVE-2026-78569 8.8 - High - September 10, 2026

IBM Langflow OSS 1.0.0 through 1.11.5 could allow an authenticated attacker to execute arbitrary code due to an incomplete denylist in the security scanner.

Shell injection

IBM Langflow OSS 1.0.0-1.11.5 RCE via unguarded eval()
CVE-2026-78571 8.8 - High - September 10, 2026

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to an unguarded eval() call on attacker-controlled input.

Code Injection

IBM Langflow OSS 1.0.0-1.11.5 Cmd Injection via MCP stdio server
CVE-2026-78575 8.8 - High - September 10, 2026

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary commands due to improper validation of command-line arguments in the MCP stdio server configuration.

Shell injection

IBM Langflow OSS 1.0.01.11.5 RAA via improper API endpoint validation
CVE-2026-79723 5 - Medium - September 10, 2026

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-controlled API endpoints.

SSRF

IBM Langflow OSS 1.0.0-1.11.5 RCE via OS Command Injection
CVE-2026-79724 9.8 - Critical - September 10, 2026

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to execute arbitrary OS commands due to improper neutralization of special elements used in an OS command.

Shell injection

IBM Langflow OSS 1.0.0-1.11.5 Auth File Read via Improper Access Control
CVE-2026-79725 6.5 - Medium - September 10, 2026

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to read arbitrary files due to improper access control.

Authorization

Langflow OSS 1.0.01.11.5 RCE via incomplete env var blocklist
CVE-2026-79742 8.8 - High - September 10, 2026

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to an incomplete environment variable blocklist.

Code Injection

IBM Langflow OSS <1.12 - RCE via Graph Construction Code Injection
CVE-2026-81204 9.8 - Critical - September 10, 2026

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to execute arbitrary code due to code injection during graph construction.

Code Injection

IBM Langflow OSS 1.0.0-1.11.5 Remote Code Exec via Custom Component Auth Bypass
CVE-2026-81211 8.8 - High - September 10, 2026

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary Python code due to improper authorization of custom components in stored flows.

AuthZ

IBM Langflow OSS 1.0.0-1.11.5 Authenticated OS Command Execution via MCP Tools
CVE-2026-81941 8.8 - High - September 10, 2026

IBM Langflow OSS 1.0.0 through 1.11.5 allows an authenticated non-administrative user could execute arbitrary operating system commands on the server at the privilege level of the application process by constructing a flow with an MCP Tools component configured to use a local stdio subprocess transport. This bypasses both the LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY and LANGFLOW_BLOCK_CODE_INTERPRETER_COMPONENTS server-side controls intended to prevent exactly this class of access. Successful exploitation could lead to arbitrary command execution, sensitive data exposure (including credentials from the process environment), file system modification, and lateral movement to services reachable from the server.

Authorization

IBM Langflow OSS 1.0.01.11.5 URL Validation Remote Info Disclosure
CVE-2026-81213 8.6 - High - September 10, 2026

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to obtain sensitive information from internal network resources due to improper validation of user-supplied URLs.

SSRF

IBM Langflow OSS 1.0.0-1.11.5: Vulnerable Component Exposes Remote Code Exec
CVE-2026-81265 7.5 - High - September 10, 2026

IBM Langflow OSS 1.0.0 through 1.11.5.

SSRF

IBM Langflow OSS 1.0.0-1.11.5 API Key Session Expiration Bypass
CVE-2026-81268 8.1 - High - September 10, 2026

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute flows and obtain sensitive information due to insufficient session expiration of API keys after user deactivation.

Insufficient Session Expiration

IBM Langflow OSS <1.12: RCE via unsanitized flow display names
CVE-2026-81940 8.8 - High - September 10, 2026

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special characters in flow display names.

Code Injection

IBM Langflow OSS 1.0.0-1.10.3 RCE via Unrestricted Pathname
CVE-2026-84889 8.8 - High - September 10, 2026

IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to improper limitation of a pathname to a restricted directory.

Directory traversal

IBM Langflow OSS 1.0.0-1.11.5 Unauth Remote Code Exec via Public MCP Endpoints
CVE-2026-85025 9.8 - Critical - September 10, 2026

IBM Langflow OSS 1.0.0 through 1.11.5 Langflow could allow an unauthenticated attacker to execute arbitrary code and access or modify chat sessions through publicly shared MCP project endpoints due to improper enforcement of public-flow security restrictions and session isolation controls.

AuthZ

IBM Langflow OSS 1.0.0-1.11.5 AuthC Bypass in File/Read File Component
CVE-2026-9225 6.5 - Medium - September 10, 2026

IBM Langflow OSS 1.0.0 through 1.11.5 Langflow could allow an authenticated attacker to access sensitive files belonging to other users due to improper access control in the File/Read File component. When executing flows through the /api/v1/run/advanced/{flow_id} endpoint, the application allows component inputs to reference storage paths using arbitrary user or flow identifiers without verifying ownership. An attacker with lowprivileged authenticated access can supply a crafted file path pointing to another users storage namespace, causing the backend to read and return the contents of files uploaded by other users. This vulnerability bypasses intended authorization checks enforced by the file management API and may result in unauthorized disclosure of sensitive user data.

Insecure Direct Object Reference / IDOR

IBM Langflow OSS 1.0.0-1.10.2 Directory Traversal via URL (dotdot)
CVE-2026-14470 6.5 - Medium - September 04, 2026

IBM Langflow OSS 1.0.0 through 1.10.2 could allow an authenticated attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.

Directory traversal

IBM Langflow OSS 1.01.10.2 Auth Bypass Enables Data Theft & Workflow Injection
CVE-2026-17627 4.9 - Medium - September 04, 2026

IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information and inject messages into workflow history due to improper authorization.

Insecure Direct Object Reference / IDOR

IBM Langflow OSS 1.0.01.10.2 Directory Traversal via URL
CVE-2026-17621 5.4 - Medium - September 04, 2026

IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot " sequences ( /.. /) to view arbitrary files on the system.

Directory traversal

IBM Langflow OSS <=1.10.2 Info Disclosure via Pathname Directory Traversal
CVE-2026-17622 6.5 - Medium - September 04, 2026

IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory.

Directory traversal

IBM Langflow OSS 1.0.0-1.10.2 SSRF Remote Authenticated Info Leak
CVE-2026-17631 5 - Medium - September 04, 2026

IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery (SSRF) vulnerability.

SSRF

Remote Auth. AUC Exec via Auth Bypass in IBM Langflow v1.01.11.2
CVE-2026-19298 8.8 - High - September 04, 2026

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to execute arbitrary code due to an authorization bypass in the flow build process.

Code Injection

ServerSide Request Forgery in IBM Langflow OSS <1.11.2
CVE-2026-19301 5 - Medium - September 04, 2026

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.

SSRF

IBM Langflow OSS <1.11.2: Remote Authenticated File Deletion via Path Traversal
CVE-2026-19303 8.1 - High - September 04, 2026

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to delete arbitrary local files or directories due to improper limitation of a pathname to a restricted directory.

Directory traversal

IBM Langflow OSS 1.0-1.11.2: Incomplete Credential Scrubbing Allows Info Leak
CVE-2026-19300 7.5 - High - September 04, 2026

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote attacker to obtain sensitive information due to incomplete scrubbing of sensitive credential fields.

Information Disclosure

IBM Langflow OSS 1.0.0-1.11.2 Path Traversal CVE-2026-19299
CVE-2026-19299 6.5 - Medium - September 04, 2026

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to path traversal.

Directory traversal

IBM Langflow OSS 1.0-1.11.2 Authenticated Remote Info Leak via Symlink
CVE-2026-19302 6.5 - Medium - September 04, 2026

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of symbolic links.

Directory traversal

IBM Langflow OSS 1.0.01.11.2 URL Parser Discrepancy -> Info Disclosure
CVE-2026-19304 7.7 - High - September 04, 2026

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information from internal services due to a URL parser discrepancy.

SSRF

IBM Langflow OSS 1.0.01.11.2 SRF
CVE-2026-19305 8.6 - High - September 04, 2026

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery.

SSRF

IBM Langflow OSS 1.01.11.2 Authenticated File Read via build request
CVE-2026-19306 7.7 - High - September 04, 2026

IBM Langflow OSS 1.0.0 through 1.11.2 allows an authenticated attacker to read arbitrary files from the server filesystem including server secret material (secret_key, JWT signing keys, the application database, /proc/self/environ, and other tenants' upload directories) by supplying absolute paths or traversal sequences in the files parameter of an authenticated build request. The file contents were embedded as text attachments in the language model prompt and transmitted to the configured model endpoint, resulting in confidential data exfiltration. This bypassed the LANGFLOW_RESTRICT_LOCAL_FILE_ACCESS=true containment boundary, which was enforced for other file-reading components but not for the Chat Input to Message attachment pipeline.

Directory traversal

IBM Langflow OSS 1.0.0-1.11.2 Auth File Write via SaveToFileComp
CVE-2026-9138 6.5 - Medium - September 04, 2026

IBM Langflow OSS 1.0.0 through 1.11.2 Langflow could allow an authenticated attacker to write arbitrary files to the server due to improper input validation in the SaveToFileComponent. The application constructs local file paths using attackercontrolled input without sufficient sanitization when handling requests to the /api/v1/run/{flow_id} endpoint. An attacker with lowprivileged authenticated access (such as a valid API key or user session) can supply crafted path values, including absolute paths or path traversal sequences, allowing arbitrary file writes to locations writable by the Langflow process. Successful exploitation may lead to unauthorized file creation or modification, potentially resulting in further compromise depending on the deployment environment.

Directory traversal

Stored XSS in IBM Langflow OSS Playground 1.0.01.11.2
CVE-2026-8447 6.1 - Medium - September 04, 2026

IBM Langflow OSS 1.0.0 through 1.11.2 suffer from a stored cross-site scripting vulnerability in the Playground chat interface.

XSS

IBM Langflow OSS <=1.11.2 Localhost Bypass via X-Forwarded-For Spoof
CVE-2026-9186 6.5 - Medium - September 04, 2026

IBM Langflow OSS 1.0.0 through 1.11.2 allows remote authenticated attackers to bypass localhost-only MCP configuration installation by spoofing X-Forwarded-For: 127.0.0.1 header, enabling arbitrary writes to IDE config files (~/.cursor/mcp.json, etc.).

Authorization

IBM Langflow OSS 1.0.0-1.11.1 Authenticated Command Exec via Flow Type
CVE-2026-19295 9.9 - Critical - August 28, 2026

IBM Langflow OSS 1.0.0 through 1.11.1 allows an authenticated attacker to execute arbitrary operating system commands in the server process by saving a flow with a crafted type field value and triggering a build of a wrapper flow that references it. This allowed privilege escalation from "authenticated flow user" to arbitrary OS-level command execution under the server process identity, bypassing the LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false policy control.

Eval Injection

IBM Langflow OSS 1.0.0-1.11.1 Auth Exfil Via Improper Auth
CVE-2026-19294 6.4 - Medium - August 28, 2026

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote authenticated attacker to execute and read any user's private flow due to improper authorization.

Insecure Direct Object Reference / IDOR

IBM Langflow OSS 1.0.0-1.11.1 Remote Code Execution via A2A Endpoint
CVE-2026-19286 9.8 - Critical - August 28, 2026

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary code due to improper enforcement of security restrictions on the A2A public endpoint.

Code Injection

IBM Langflow OSS 1.0.0-1.11.1 NS Collision Remote Info Disclosure & Msg Injection
CVE-2026-18904 8.2 - High - August 28, 2026

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to obtain sensitive information and inject unauthorized messages due to a namespace collision between user identifiers.

Insecure Direct Object Reference / IDOR

IBM Langflow OSS 1.0.01.11.1 Remote File Path Traversal
CVE-2026-18899 7.5 - High - August 28, 2026

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to read arbitrary files due to path traversal.

Directory traversal

IBM Langflow OSS 1.0.0-1.11.1 Improper Auth RCE
CVE-2026-18891 8.2 - High - August 28, 2026

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary flows and access sensitive information due to improper authentication.

authentification

IBM Langflow OSS RCE via improper code gen in 1.0.01.11.1
CVE-2026-18729 8.8 - High - August 28, 2026

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code.

Code Injection

IBM Langflow OSS SSRF Vulnerability 1.0.0-1.11.1
CVE-2026-18545 4.3 - Medium - August 28, 2026

IBM Langflow OSS 1.0.0 through 1.11.1 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

SSRF

IBM Langflow OSS 1.01.9.6 Unchecked Auth Attempts Expose Accounts
CVE-2026-19297 9.1 - Critical - August 13, 2026

IBM Langflow OSS 1.0.0 through 1.9.6 could allow a remote attacker to obtain unauthorized access to user accounts due to improper restriction of excessive authentication attempts.

Improper Restriction of Excessive Authentication Attempts

Stay on top of Security Vulnerabilities

Want an email whenever new vulnerabilities are published for IBM Langflow Oss or by IBM? Click the Watch button to subscribe.

IBM
Vendor

IBM Langflow Oss
Product

subscribe