CVE-2026-79742: Improper Control of Generation of Code

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to an incomplete environment variable blocklist...

CVE-2026-79725: Improper Access Control

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to read arbitrary files due to improper access control...

CVE-2026-81204: Improper Control of Generation of Code

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to execute arbitrary code due to code injection during graph construction...

CVE-2026-81268: Insufficient Session Expiration

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute flows and obtain sensitive information due to insufficient session expiration of API keys after user deactivation...

CVE-2026-81941: Improper Access Control

IBM Langflow OSS 1.0.0 through 1.11.5 allows an authenticated non-administrative user could execute arbitrary operating system commands on the server at the privilege level of the application process by constructing a flow with an MCP Tools component configured to use a local stdio subprocess...

PT-2026-89591

IBM Langflow OSS 1.0.0 through 1.11.5 Langflow could allow an authenticated attacker to access sensitive files belonging to other users due to improper access control in the File/Read File component. When executing flows through the /api/v1/run/advanced/flow id endpoint, the application allows...

PT-2026-89637

🚨 CVE-2026-81941 IBM Langflow OSS 1.0.0 through 1.11.5 allows an authenticated non-administrative user could execute arbitrary operating system commands on the server at the privilege level of the application process by constructing a flow with an MCP Tools component configured to use a local std...

CVE-2026-9225: Authorization Bypass Through User-Controlled Key

IBM Langflow OSS 1.0.0 through 1.11.5 Langflow could allow an authenticated attacker to access sensitive files belonging to other users due to improper access control in the File/Read File component. When executing flows through the /api/v1/run/advanced/flowid endpoint, the application allows...

CVE-2026-79724: Improper Neutralization of Special Elements used in an OS Command

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to execute arbitrary OS commands due to improper neutralization of special elements used in an OS command...

PT-2026-89629

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.11.5 Description Improper validation of user-supplied URLs allows a remote attacker to obtain sensitive information from internal network resources. This issue is a Server-Side Request Forgery SSRF,...

CVE-2026-81213: Server-Side Request Forgery (SSRF)

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to obtain sensitive information from internal network resources due to improper validation of user-supplied URLs...

PT-2026-89636

🚨 CVE-2026-81940 IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special characters in flow display names. 🎖@cveNotify...

CVE-2026-78569: Improper Neutralization of Special Elements used in an OS Command

IBM Langflow OSS 1.0.0 through 1.11.5 could allow an authenticated attacker to execute arbitrary code due to an incomplete denylist in the security scanner...

CVE-2026-81940: Improper Control of Generation of Code

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special characters in flow display names...

Langflow AI Authenticated Remote Code Execution

Langflow versions 1.11.1 and below are susceptible to authenticated remote code execution. By saving a flow where data.type is empty, an authenticated user can bypass the flow guard and execute arbitrary Python code. https://packetstorm.news/download/231016...

Security Bulletin: Langflow is affected by improper authentication due to missing password verification in the password reset endpoint

Summary Langflow provides a password reset capability through its user management API. The password reset endpoint accepts a current password field in the request body but does not verify it against the stored credential before applying the password change, and enforces no password complexity...

Security Bulletin: Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards

Summary Langflow uses a code security scanner and component-level execution policies to restrict server-side code execution to authorized users and contexts. The agentic assistant code scanner employs an incomplete denylist omitting process-spawning primitives and contains a logic error where...

Security Bulletin: Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches

Summary Langflow and its bundled connectors perform server-side HTTP requests using URLs supplied by authenticated users without consistently applying the platform's connector SSRF validation guard. The MCP server configuration URL field accepts any HTTP or HTTPS target including RFC 1918,...

Security Bulletin: Langflow is vulnerable to authentication bypass and insufficient session expiration

Summary Langflow provides API key-based authentication for programmatic access to flow execution and MCP endpoints. The MCP HTTP API credential resolvers do not apply the same AUTOLOGIN API-key guard that all standard authenticated endpoints enforce; when Langflow is in its default AUTOLOGIN...

Security Bulletin: Langflow is vulnerable to unauthorized file system access due to path traversal and missing storage path validation

Summary Langflow uses a local and S3-backed storage service to manage files uploaded by users and referenced by flow components. The flow execution runtime accepts attacker-controlled file paths through the tweaks API without invoking the path containment guard, allowing traversal sequences to...