Langflow Langflow vulnerabilities

CVE-2026-81941 High · 8.8 CWE-284 Sep 10, 2026

Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards

IBM Langflow OSS 1.0.0 through 1.11.5 allows an authenticated non-administrative user could execute arbitrary operating system commands on the server at the privilege level of the application process by constructing a flow with an MCP Tools component configured to use a local stdio subprocess transport. This bypasses both the LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY and LANGFLOW_BLOCK_CODE_INTERPRETER_COMPONENTS server-side controls intended to prevent exactly this class of access. Successful exploitation could lead to arbitrary command execution, sensitive data exposure (including credentials from the process environment), file system modification, and lateral movement to services reachable from the server.

CVE-2026-81940 High · 8.8 CWE-94 Sep 10, 2026

Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special characters in flow display names.

CVE-2026-81268 High · 8.1 CWE-613 Sep 10, 2026

Langflow is vulnerable to authentication bypass and insufficient session expiration

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute flows and obtain sensitive information due to insufficient session expiration of API keys after user deactivation.

CVE-2026-81265 High · 7.5 CWE-918 Sep 10, 2026

Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches

IBM Langflow OSS 1.0.0 through 1.11.5.

CVE-2026-81213 High · 8.6 CWE-918 Sep 10, 2026

Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to obtain sensitive information from internal network resources due to improper validation of user-supplied URLs.

CVE-2026-81211 High · 8.8 CWE-862 Sep 10, 2026

Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary Python code due to improper authorization of custom components in stored flows.

CVE-2026-81204 Critical · 9.8 CWE-94 Sep 10, 2026

Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to execute arbitrary code due to code injection during graph construction.

CVE-2026-79742 High · 8.8 CWE-94 Sep 10, 2026

Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to an incomplete environment variable blocklist.

CVE-2026-79725 Medium · 6.5 CWE-284 Sep 10, 2026

Langflow is vulnerable to unauthorized file system access due to path traversal and missing storage path validation

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to read arbitrary files due to improper access control.

CVE-2026-79724 Critical · 9.8 CWE-78 Sep 10, 2026

Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to execute arbitrary OS commands due to improper neutralization of special elements used in an OS command.

CVE-2026-79723 Medium · 5.0 CWE-918 Sep 10, 2026

Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-controlled API endpoints.

CVE-2026-78575 High · 8.8 CWE-78 Sep 10, 2026

Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary commands due to improper validation of command-line arguments in the MCP stdio server configuration.

CVE-2026-78571 High · 8.8 CWE-94 Sep 10, 2026

Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to an unguarded eval() call on attacker-controlled input.

CVE-2026-78569 High · 8.8 CWE-78 Sep 10, 2026

Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards

IBM Langflow OSS 1.0.0 through 1.11.5 could allow an authenticated attacker to execute arbitrary code due to an incomplete denylist in the security scanner.

CVE-2026-76059 High · 8.8 CWE-693 Sep 10, 2026

Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards

IBM Langflow OSS 1.0.0 through 1.11.5 An attacker who could submit custom component source code could bypass the static security scanner by crafting an annotated class-body assignment that resolved to a dangerous callable through alias tracking; the resolved value was never checked against the dangerous callable blocklist due to the logic error. If the crafted component reached the runtime execution path, the attacker could cause arbitrary operating system commands to execute on the server in-process, with the privileges of the running service.

CVE-2026-9225 Medium · 6.5 CWE-639 Sep 10, 2026

Langflow is vulnerable to unauthorized file system access due to path traversal and missing storage path validation

IBM Langflow OSS 1.0.0 through 1.11.5 Langflow could allow an authenticated attacker to access sensitive files belonging to other users due to improper access control in the File/Read File component. When executing flows through the /api/v1/run/advanced/{flow_id} endpoint, the application allows component inputs to reference storage paths using arbitrary user or flow identifiers without verifying ownership. An attacker with low‑privileged authenticated access can supply a crafted file path pointing to another user’s storage namespace, causing the backend to read and return the contents of files uploaded by other users. This vulnerability bypasses intended authorization checks enforced by the file management API and may result in unauthorized disclosure of sensitive user data.

CVE-2026-85025 Critical · 9.8 CWE-863 Sep 10, 2026

Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards

IBM Langflow OSS 1.0.0 through 1.11.5 Langflow could allow an unauthenticated attacker to execute arbitrary code and access or modify chat sessions through publicly shared MCP project endpoints due to improper enforcement of public-flow security restrictions and session isolation controls.

CVE-2026-17631 Medium · 6.5 CWE-918 Sep 4, 2026

Langflow OSS is affected by server-side request forgery due to missing URL validation in flow components

IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery (SSRF) vulnerability.

CVE-2026-17627 High · 7.1 CWE-639 Sep 4, 2026

Langflow is affected by improper authorization due to missing access control on the voice-mode WebSocket endpoint

IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information and inject messages into workflow history due to improper authorization.

CVE-2026-17622 Medium · 6.5 CWE-22 Sep 4, 2026

Langflow OSS is affected by arbitrary file read due to path traversal vulnerabilities in file and knowledge base components

IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory.

CVE-2026-17621 Medium · 5.4 CWE-22 Sep 4, 2026

Langflow OSS is affected by arbitrary file read due to path traversal vulnerabilities in file and knowledge base components

IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot " sequences ( /.. /) to view arbitrary files on the system.

CVE-2026-14470 Medium · 6.5 CWE-22 Sep 4, 2026

Langflow OSS is affected by arbitrary file read due to path traversal vulnerabilities in file and knowledge base components

IBM Langflow OSS 1.0.0 through 1.10.2 could allow an authenticated attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.

CVE-2026-19306 High · 7.7 CWE-22 Sep 4, 2026

Langflow is vulnerable to arbitrary local file read due to path traversal in ChatInput, bundle FileInput, and GitExtractor components

IBM Langflow OSS 1.0.0 through 1.11.2 allows an authenticated attacker to read arbitrary files from the server filesystem — including server secret material (secret_key, JWT signing keys, the application database, /proc/self/environ, and other tenants' upload directories) — by supplying absolute paths or traversal sequences in the files parameter of an authenticated build request. The file contents were embedded as text attachments in the language model prompt and transmitted to the configured model endpoint, resulting in confidential data exfiltration. This bypassed the LANGFLOW_RESTRICT_LOCAL_FILE_ACCESS=true containment boundary, which was enforced for other file-reading components but not for the Chat Input to Message attachment pipeline.

CVE-2026-19305 High · 7.5 CWE-918 Sep 4, 2026

Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery.

CVE-2026-19304 High · 7.7 CWE-918 Sep 4, 2026

Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information from internal services due to a URL parser discrepancy.