CVE-2026-7646: Improper Limitation of a Pathname to a Restricted Directory

IBM Langflow OSS 1.0.0 through 1.10.3 allows users to read arbitrary files from the server filesystem, including other users' uploaded documents, the JWT signing secret, the SQLite database, and process environment variables, by sending a crafted MCP resources/read request with a URL-encoded path...

PT-2026-68226

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.10.3 Description An authenticated attacker can read, modify, or expose sensitive host files through Docker-based MCP servers. This occurs because of incomplete filtering of dangerous Docker volume-moun...

PT-2026-68253

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.10.3 Description An issue allows users to read arbitrary files from the server filesystem by sending a crafted MCP resources/read request. By using a URL-encoded path traversal sequence in the filename...

CVE-2026-8470: Use of a Broken or Risky Cryptographic Algorithm

IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 use Python's non-cryptographic random module for generating Fernet encryption keys from user secrets under 32 characters. The deterministic Mersenne Twister PRNG produces identical keys for...

PT-2026-68293

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.10.3 Description The software uses Python's non-cryptographic random module to generate Fernet encryption keys when user secrets are shorter than 32 characters. This process relies on the Mersenne...

CVE-2026-17626: Incorrect Privilege Assignment

IBM Langflow OSS 1.0.0 through 1.10.3 Langflow could allow an authenticated attacker to read, modify, or expose sensitive host files via Docker-based MCP servers due to incomplete filtering of dangerous Docker volume-mount and device-mapping arguments...

CVE-2026-10547: Improper Access Control

IBM Langflow OSS 1.0.0 through 1.10.3 does not properly validate ownership in the deprecated POST /api/v1/build/flowid/vertices endpoint, allowing an authenticated user to inject arbitrary graph data into a shared cache for any flow. This may result in cross-user cache pollution, unauthorized...

PT-2026-68290

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.10.3 Description Improper validation of the username field allows attackers to inject path traversal sequences—a technique used to access files and directories outside the intended folder—and bypass...

PT-2026-68303

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.10.3 Description Remote attackers can execute arbitrary code on the server without authentication by sending two HTTP requests. Recommendations Update IBM Langflow OSS to a version later than 1.10.3...

PT-2026-68295

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.10.3 Description A Server-Side Request Forgery SSRF issue exists in the validate model provider key function for the Ollama provider. The function processes a user-supplied OLLAMA BASE URL parameter an...

PT-2026-68297

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS affected versions not specified Description An issue exists involving weak cryptographic key derivation within the ensure fernet key function. Key derivation is the process of deriving one or more secret keys from a master key...

CVE-2026-9205: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

IBM Langflow OSS contains a weak cryptographic key derivation vulnerability in the ensurefernetkey function...

PT-2026-68305

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.10.3 Description An authenticated attacker can execute arbitrary code due to a cryptographic weakness in the custom component validation mechanism. When the optional hardening mode is enabled to restri...

CVE-2026-17630: Incomplete List of Disallowed Inputs

IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote attacker to execute arbitrary code due to improper validation of configuration parameters...

PT-2026-68291

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.10.3 Description An authenticated attacker can perform a Path Traversal attack via the Knowledge Bases API endpoint POST /api/v1/knowledge bases. This issue arises because the system uses user-supplied...

PT-2026-68294

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.10.3 Description Improper control of user input code allows a remote attacker to inject and execute arbitrary code on the system. Recommendations Update IBM Langflow OSS to a version later than 1.10.3...

PT-2026-68292

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.10.3 Description A remote attacker can perform directory traversal on the system. By sending a specially crafted URL request containing dot-dot-slash /../ sequences, an attacker can view arbitrary file...

PT-2026-68298

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.10.3 Description Improper validation of module imports allows a remote authenticated attacker to execute arbitrary code. Recommendations At the moment, there is no information about a newer version tha...

PT-2026-68259

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.10.3 Description Insufficient ownership validation in the deprecated 'POST /api/v1/build/flow id/vertices' endpoint allows an authenticated user to inject arbitrary graph data into a shared cache for a...

CVE-2026-9196: Improper Control of Generation of Code

IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute unintended code during Agentic Assistant validation due to improper handling of LLM‑generated components. The application executes model‑generated Python code in the backend during validation prior to user...