Vulnerabilities handled in IBM Langflow OSS

IBM has addressed several vulnerabilities in the IBM Langflow OSS versions from 1.0.0 to 1.10.0. The vulnerabilities in IBM Langflow OSS include: - Execution of arbitrary file modifications by authorized users through specially crafted Content-Disposition headers. - Server-side request forgery SS...

CVE-2026-9103 Unauthenticated Superuser Token Issuance via Auto-Login Endpoint

IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to gain unauthorized access due to improper authentication in the /api/v1/login/autologin endpoint. The endpoint issues long-lived superuser bearer tokens without requiring authentication when the AUTOLOGIN configuration is enabl...

EUVD-2026-45236

IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/autologin mints SUPERUSER tokens to any network caller with /api/v1/validate/code executes user code via exec to achieve full RCE on default Langflow deployments...

CVE-2026-9198

IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/autologin mints SUPERUSER tokens to any network caller with /api/v1/validate/code executes user code via exec to achieve full RCE on default Langflow deployments...

CVE-2026-9198 Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation

IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/autologin mints SUPERUSER tokens to any network caller with /api/v1/validate/code executes user code via exec to achieve full RCE on default Langflow deployments...

PT-2026-60839

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.10.0 Description Improper authentication in the '/api/v1/login/auto login' endpoint allows remote attackers to gain unauthorized administrative access. When the AUTO LOGIN configuration is enabled, whi...

Security Bulletin: Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation

Summary A vulnerability allowed unauthenticated attackers to achieve remote code execution on default-configured instances. The vulnerability combined two distinct issues: an unauthenticated endpoint that issued superuser bearer tokens to any network caller, and a code validation endpoint that...

PT-2026-60833

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.10.0 Description Unauthenticated attackers can achieve remote code execution RCE on default deployments by chaining two endpoints. First, the '/api/v1/auto login' endpoint allows the minting of SUPERUS...