Vulnerabilidades do Ibm Langflow OSS

CVE-2026-12767 Média · 6.5 CWE-918 14/09/2026

Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches

IBM Langflow OSS 1.0.0 through 1.11.5 is vulnerable to server-side request forgery (SSRF). This may allow an unauthenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

CVE-2026-12766 Média · 5.4 CWE-918 14/09/2026

Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components

IBM Langflow OSS 1.0.0 through 1.11.2 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

CVE-2026-12765 Média · 6.5 CWE-918 14/09/2026

Langflow OSS is affected by server-side request forgery due to missing URL validation in flow components

IBM Langflow OSS 1.0.0 through 1.10.2 is vulnerable to server-side request forgery (SSRF). This may allow an unauthenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

CVE-2026-12763 Média · 4.2 CWE-306 14/09/2026

Langflow is vulnerable to authentication bypass and insufficient session expiration

IBM Langflow OSS 1.0.0 through 1.11.5 could allow an authenticated attacker to access another user's MCP server context due to improper cache key isolation in the MCP Tools component.

CVE-2026-17628 Média · 5.4 CWE-287 14/09/2026

Langflow is affected by improper authentication due to missing password verification in the password reset endpoint

IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to change the password of an account due to improper authentication.

CVE-2026-84889 Alta · 8.8 CWE-22 10/09/2026

A path traversal vulnerability in file handling components could allow an authenticated attacker to write files to arbitrary locations on the server filesystem

IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to improper limitation of a pathname to a restricted directory.

CVE-2026-81941 Alta · 8.8 CWE-284 10/09/2026

Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards

IBM Langflow OSS 1.0.0 through 1.11.5 allows an authenticated non-administrative user could execute arbitrary operating system commands on the server at the privilege level of the application process by constructing a flow with an MCP Tools component configured to use a local stdio subprocess transport. This bypasses both the LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY and LANGFLOW_BLOCK_CODE_INTERPRETER_COMPONENTS server-side controls intended to prevent exactly this class of access. Successful exploitation could lead to arbitrary command execution, sensitive data exposure (including credentials from the process environment), file system modification, and lateral movement to services reachable from the server.

CVE-2026-81940 Alta · 8.8 CWE-94 10/09/2026

Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special characters in flow display names.

CVE-2026-81268 Alta · 8.1 CWE-613 10/09/2026

Langflow is vulnerable to authentication bypass and insufficient session expiration

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute flows and obtain sensitive information due to insufficient session expiration of API keys after user deactivation.

CVE-2026-81265 Alta · 7.5 CWE-918 10/09/2026

Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches

IBM Langflow OSS 1.0.0 through 1.11.5.

CVE-2026-81213 Alta · 8.6 CWE-918 10/09/2026

Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to obtain sensitive information from internal network resources due to improper validation of user-supplied URLs.

CVE-2026-81211 Alta · 8.8 CWE-862 10/09/2026

Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary Python code due to improper authorization of custom components in stored flows.

CVE-2026-81204 Crítica · 9.8 CWE-94 10/09/2026

Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to execute arbitrary code due to code injection during graph construction.

CVE-2026-79742 Alta · 8.8 CWE-94 10/09/2026

Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to an incomplete environment variable blocklist.

CVE-2026-79725 Média · 6.5 CWE-284 10/09/2026

Langflow is vulnerable to unauthorized file system access due to path traversal and missing storage path validation

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to read arbitrary files due to improper access control.

CVE-2026-79724 Crítica · 9.8 CWE-78 10/09/2026

Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to execute arbitrary OS commands due to improper neutralization of special elements used in an OS command.

CVE-2026-79723 Média · 5.0 CWE-918 10/09/2026

Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-controlled API endpoints.

CVE-2026-78575 Alta · 8.8 CWE-78 10/09/2026

Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary commands due to improper validation of command-line arguments in the MCP stdio server configuration.

CVE-2026-78571 Alta · 8.8 CWE-94 10/09/2026

Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to an unguarded eval() call on attacker-controlled input.

CVE-2026-78569 Alta · 8.8 CWE-78 10/09/2026

Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards

IBM Langflow OSS 1.0.0 through 1.11.5 could allow an authenticated attacker to execute arbitrary code due to an incomplete denylist in the security scanner.

CVE-2026-76059 Alta · 8.8 CWE-693 10/09/2026

Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards

IBM Langflow OSS 1.0.0 through 1.11.5 An attacker who could submit custom component source code could bypass the static security scanner by crafting an annotated class-body assignment that resolved to a dangerous callable through alias tracking; the resolved value was never checked against the dangerous callable blocklist due to the logic error. If the crafted component reached the runtime execution path, the attacker could cause arbitrary operating system commands to execute on the server in-process, with the privileges of the running service.

CVE-2026-9225 Média · 6.5 CWE-639 10/09/2026

Langflow is vulnerable to unauthorized file system access due to path traversal and missing storage path validation

IBM Langflow OSS 1.0.0 through 1.11.5 Langflow could allow an authenticated attacker to access sensitive files belonging to other users due to improper access control in the File/Read File component. When executing flows through the /api/v1/run/advanced/{flow_id} endpoint, the application allows component inputs to reference storage paths using arbitrary user or flow identifiers without verifying ownership. An attacker with low‑privileged authenticated access can supply a crafted file path pointing to another user’s storage namespace, causing the backend to read and return the contents of files uploaded by other users. This vulnerability bypasses intended authorization checks enforced by the file management API and may result in unauthorized disclosure of sensitive user data.

CVE-2026-85025 Crítica · 9.8 CWE-863 10/09/2026

Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards

IBM Langflow OSS 1.0.0 through 1.11.5 Langflow could allow an unauthenticated attacker to execute arbitrary code and access or modify chat sessions through publicly shared MCP project endpoints due to improper enforcement of public-flow security restrictions and session isolation controls.

CVE-2026-17631 Média · 6.5 CWE-918 04/09/2026

Langflow OSS is affected by server-side request forgery due to missing URL validation in flow components

IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery (SSRF) vulnerability.

CVE-2026-17627 Alta · 7.1 CWE-639 04/09/2026

Langflow is affected by improper authorization due to missing access control on the voice-mode WebSocket endpoint

IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information and inject messages into workflow history due to improper authorization.