IBM Langflow Oss
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in IBM Langflow Oss.
By the Year
In 2026 there have been 136 vulnerabilities in IBM Langflow Oss with an average score of 8.0 out of ten.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 136 | 8.01 |
It may take a day or so for new Langflow Oss vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent IBM Langflow Oss Security Vulnerabilities
IBM Langflow OSS Rce via Unchecked Code Gen 1.0.0-1.12.2
CVE-2026-88962
8.8 - High
- October 07, 2026
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code generation.
Code Injection
IBM Langflow OSS 1.0.01.12.2 RCE via Special Element Leakage
CVE-2026-93443
7.5 - High
- October 07, 2026
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in code.
Code Injection
IBM Langflow OSS 1.0.0-1.12.2 Path Limitation Exposes Sensitive Info
CVE-2026-93448
6.5 - Medium
- October 07, 2026
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory.
Directory traversal
IBM Langflow OSS 1.0.0-1.12.2 Auth Remote Code Exec via Improper Code Gen
CVE-2026-93449
8.5 - High
- October 07, 2026
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code generation.
Code Injection
IBM Langflow OSS RCE via Improper Code Gen 1.0.0-1.12.2
CVE-2026-93445
8.1 - High
- October 07, 2026
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code.
Code Injection
IBM Langflow OSS 1.x Deserialization Vulnerability (1.0.0-1.12.2)
CVE-2026-93447
7.5 - High
- October 07, 2026
IBM Langflow OSS 1.0.0 through 1.12.2 could allow an attacker with access to the server secret and Redis write access to submit a malicious serialized cache value. When the value was retrieved, deserialization could have executed attacker-controlled code with the privileges of the service process.
Marshaling, Unmarshaling
IBM Langflow OSS 1.0-1.12.2 RCE via Dependency Confusion
CVE-2026-93675
8.8 - High
- October 07, 2026
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to an expected dependency confusion.
Expected Behavior Violation
IBM Langflow OSS 1.12.2 Remote Authenticated Info Disclosure
CVE-2026-93677
7.7 - High
- October 07, 2026
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to exposure of sensitive information to an unauthorized actor.
Information Disclosure
IBM Langflow OSS 1.01.12.2 Improper Auth Enables Sensitive Data Leak
CVE-2026-93678
7.6 - High
- October 07, 2026
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization.
Insecure Direct Object Reference / IDOR
IBM Langflow OSS 1.12.2 Uncontrolled ZIP Extraction Denial of Service
CVE-2026-93679
4.3 - Medium
- October 07, 2026
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to cause a denial of service due to uncontrolled resource consumption during ZIP file extraction.
Resource Exhaustion
IBM Langflow OSS 1.0.0-1.12.2 OS Command Injection Remote Code Exec
CVE-2026-93674
9.8 - Critical
- October 07, 2026
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.
Code Injection
IBM Langflow OSS 1.0.0-1.12.2 Path Traversal allows Remote Authenticated Info Disclosure
CVE-2026-97671
6.5 - Medium
- October 07, 2026
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to a path traversal vulnerability.
Directory traversal
IBM Langflow OSS 1.12.2 RCE via Improper Input Validation
CVE-2026-97673
8.8 - High
- October 07, 2026
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper input validation.
Protection Mechanism Failure
IBM Langflow OSS 1.0.0-1.12.2 Remote Authenticated OS Command Injection
CVE-2026-97674
8.1 - High
- October 06, 2026
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary OS commands due to improper neutralization of special elements used in an OS command ('Code Injection'), aka improper control of code generation.
Code Injection
IBM Langflow OSS 1.0.01.12.2 RCE via Improper Input Validation
CVE-2026-97678
8.8 - High
- October 06, 2026
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper input validation.
Protection Mechanism Failure
IBM Langflow OSS 1.0.0-1.12.2 Remote Auth Code Injection via OS Commands
CVE-2026-97679
8.8 - High
- October 06, 2026
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command ('Code Injection') related to improper input validation.
Code Injection
IBM Langflow OSS 1.12.2 - Improper Access Control in Vertex Result Cache
CVE-2026-97680
8.3 - High
- October 06, 2026
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information or inject malicious data due to improper access control in the vertex result caching subsystem.
Authorization
IBM Langflow RCE via Incomplete Blocklist 1.0.0-1.12.2
CVE-2026-97655
8.8 - High
- October 06, 2026
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to an incomplete blocklist in the code security scanner.
Code Injection
IBM Langflow OSS 1.12.2 Remote Authenticated RCE via Sandbox Escape
CVE-2026-97676
8.8 - High
- October 06, 2026
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in code, resulting in a sandbox escape.
Code Injection
IBM Langflow OSS 1.0.0-1.10.0 Arbitrary Python Code Exec via Component Imports
CVE-2026-12944
9.6 - Critical
- September 14, 2026
IBM Langflow OSS 1.0.0 through 1.10.0 can allow attackers to execute arbitrary Python code with root privileges (UID=0) on the Langflow server by submitting components containing socket or urllib imports. This enables: (1) AWS credential theft via IMDSv1 SSRF with full IAM role permissions, (2) arbitrary file exfiltration from the container filesystem, and (3) lateral movement to internal services (PostgreSQL, Redis) within the Docker network. The scanner incorrectly returns "validated": true, providing a false security signal.
SSRF
IBM Langflow OSS 1.0.0 through 1.11.5 could
CVE-2026-12763
4.2 - Medium
- September 14, 2026
IBM Langflow OSS 1.0.0 through 1.11.5 could allow an authenticated attacker to access another user's MCP server context due to improper cache key isolation in the MCP Tools component.
Missing Authentication for Critical Function
IBM Langflow OSS 1.0.0 through 1.10.2 is vulnerable to server-side request forgery (SSRF)
CVE-2026-12765
6.5 - Medium
- September 14, 2026
IBM Langflow OSS 1.0.0 through 1.10.2 is vulnerable to server-side request forgery (SSRF). This may allow an unauthenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
SSRF
IBM Langflow OSS 1.0.0 through 1.11.2 is vulnerable to server-side request forgery (SSRF)
CVE-2026-12766
5.4 - Medium
- September 14, 2026
IBM Langflow OSS 1.0.0 through 1.11.2 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
SSRF
IBM Langflow OSS 1.0.0 through 1.11.5 is vulnerable to server-side request forgery (SSRF)
CVE-2026-12767
6.5 - Medium
- September 14, 2026
IBM Langflow OSS 1.0.0 through 1.11.5 is vulnerable to server-side request forgery (SSRF). This may allow an unauthenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
SSRF
IBM Langflow OSS 1.0.0 through 1.10.2 could
CVE-2026-17628
5.4 - Medium
- September 14, 2026
IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to change the password of an account due to improper authentication.
authentification
IBM Langflow OSS 1.0.0-1.11.5 Arbitrary OS Exec via Custom Comp Injection
CVE-2026-76059
8.8 - High
- September 10, 2026
IBM Langflow OSS 1.0.0 through 1.11.5 An attacker who could submit custom component source code could bypass the static security scanner by crafting an annotated class-body assignment that resolved to a dangerous callable through alias tracking; the resolved value was never checked against the dangerous callable blocklist due to the logic error. If the crafted component reached the runtime execution path, the attacker could cause arbitrary operating system commands to execute on the server in-process, with the privileges of the running service.
Protection Mechanism Failure
IBM Langflow OSS 1.0.0-1.11.5 Auth RCE via Denylist
CVE-2026-78569
8.8 - High
- September 10, 2026
IBM Langflow OSS 1.0.0 through 1.11.5 could allow an authenticated attacker to execute arbitrary code due to an incomplete denylist in the security scanner.
Shell injection
IBM Langflow OSS 1.0.0-1.11.5 RCE via unguarded eval()
CVE-2026-78571
8.8 - High
- September 10, 2026
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to an unguarded eval() call on attacker-controlled input.
Code Injection
IBM Langflow OSS 1.0.0-1.11.5 Cmd Injection via MCP stdio server
CVE-2026-78575
8.8 - High
- September 10, 2026
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary commands due to improper validation of command-line arguments in the MCP stdio server configuration.
Shell injection
IBM Langflow OSS 1.0.01.11.5 RAA via improper API endpoint validation
CVE-2026-79723
5 - Medium
- September 10, 2026
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-controlled API endpoints.
SSRF
IBM Langflow OSS 1.0.0-1.11.5 RCE via OS Command Injection
CVE-2026-79724
9.8 - Critical
- September 10, 2026
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to execute arbitrary OS commands due to improper neutralization of special elements used in an OS command.
Shell injection
IBM Langflow OSS 1.0.0-1.11.5 Auth File Read via Improper Access Control
CVE-2026-79725
6.5 - Medium
- September 10, 2026
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to read arbitrary files due to improper access control.
Authorization
Langflow OSS 1.0.01.11.5 RCE via incomplete env var blocklist
CVE-2026-79742
8.8 - High
- September 10, 2026
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to an incomplete environment variable blocklist.
Code Injection
IBM Langflow OSS <1.12 - RCE via Graph Construction Code Injection
CVE-2026-81204
9.8 - Critical
- September 10, 2026
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to execute arbitrary code due to code injection during graph construction.
Code Injection
IBM Langflow OSS 1.0.0-1.11.5 Remote Code Exec via Custom Component Auth Bypass
CVE-2026-81211
8.8 - High
- September 10, 2026
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary Python code due to improper authorization of custom components in stored flows.
AuthZ
IBM Langflow OSS 1.0.0-1.11.5 Authenticated OS Command Execution via MCP Tools
CVE-2026-81941
8.8 - High
- September 10, 2026
IBM Langflow OSS 1.0.0 through 1.11.5 allows an authenticated non-administrative user could execute arbitrary operating system commands on the server at the privilege level of the application process by constructing a flow with an MCP Tools component configured to use a local stdio subprocess transport. This bypasses both the LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY and LANGFLOW_BLOCK_CODE_INTERPRETER_COMPONENTS server-side controls intended to prevent exactly this class of access. Successful exploitation could lead to arbitrary command execution, sensitive data exposure (including credentials from the process environment), file system modification, and lateral movement to services reachable from the server.
Authorization
IBM Langflow OSS 1.0.01.11.5 URL Validation Remote Info Disclosure
CVE-2026-81213
8.6 - High
- September 10, 2026
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to obtain sensitive information from internal network resources due to improper validation of user-supplied URLs.
SSRF
IBM Langflow OSS 1.0.0-1.11.5: Vulnerable Component Exposes Remote Code Exec
CVE-2026-81265
7.5 - High
- September 10, 2026
IBM Langflow OSS 1.0.0 through 1.11.5.
SSRF
IBM Langflow OSS 1.0.0-1.11.5 API Key Session Expiration Bypass
CVE-2026-81268
8.1 - High
- September 10, 2026
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute flows and obtain sensitive information due to insufficient session expiration of API keys after user deactivation.
Insufficient Session Expiration
IBM Langflow OSS <1.12: RCE via unsanitized flow display names
CVE-2026-81940
8.8 - High
- September 10, 2026
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special characters in flow display names.
Code Injection
IBM Langflow OSS 1.0.0-1.10.3 RCE via Unrestricted Pathname
CVE-2026-84889
8.8 - High
- September 10, 2026
IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to improper limitation of a pathname to a restricted directory.
Directory traversal
IBM Langflow OSS 1.0.0-1.11.5 Unauth Remote Code Exec via Public MCP Endpoints
CVE-2026-85025
9.8 - Critical
- September 10, 2026
IBM Langflow OSS 1.0.0 through 1.11.5 Langflow could allow an unauthenticated attacker to execute arbitrary code and access or modify chat sessions through publicly shared MCP project endpoints due to improper enforcement of public-flow security restrictions and session isolation controls.
AuthZ
IBM Langflow OSS 1.0.0-1.11.5 AuthC Bypass in File/Read File Component
CVE-2026-9225
6.5 - Medium
- September 10, 2026
IBM Langflow OSS 1.0.0 through 1.11.5 Langflow could allow an authenticated attacker to access sensitive files belonging to other users due to improper access control in the File/Read File component. When executing flows through the /api/v1/run/advanced/{flow_id} endpoint, the application allows component inputs to reference storage paths using arbitrary user or flow identifiers without verifying ownership. An attacker with lowprivileged authenticated access can supply a crafted file path pointing to another users storage namespace, causing the backend to read and return the contents of files uploaded by other users. This vulnerability bypasses intended authorization checks enforced by the file management API and may result in unauthorized disclosure of sensitive user data.
Insecure Direct Object Reference / IDOR
IBM Langflow OSS 1.0.0-1.10.2 Directory Traversal via URL (dotdot)
CVE-2026-14470
6.5 - Medium
- September 04, 2026
IBM Langflow OSS 1.0.0 through 1.10.2 could allow an authenticated attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.
Directory traversal
IBM Langflow OSS 1.01.10.2 Auth Bypass Enables Data Theft & Workflow Injection
CVE-2026-17627
4.9 - Medium
- September 04, 2026
IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information and inject messages into workflow history due to improper authorization.
Insecure Direct Object Reference / IDOR
IBM Langflow OSS 1.0.01.10.2 Directory Traversal via URL
CVE-2026-17621
5.4 - Medium
- September 04, 2026
IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot " sequences ( /.. /) to view arbitrary files on the system.
Directory traversal
IBM Langflow OSS <=1.10.2 Info Disclosure via Pathname Directory Traversal
CVE-2026-17622
6.5 - Medium
- September 04, 2026
IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory.
Directory traversal
IBM Langflow OSS 1.0.0-1.10.2 SSRF Remote Authenticated Info Leak
CVE-2026-17631
5 - Medium
- September 04, 2026
IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery (SSRF) vulnerability.
SSRF
Remote Auth. AUC Exec via Auth Bypass in IBM Langflow v1.01.11.2
CVE-2026-19298
8.8 - High
- September 04, 2026
IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to execute arbitrary code due to an authorization bypass in the flow build process.
Code Injection
ServerSide Request Forgery in IBM Langflow OSS <1.11.2
CVE-2026-19301
5 - Medium
- September 04, 2026
IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
SSRF
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for IBM Langflow Oss or by IBM? Click the Watch button to subscribe.
