Langflow : Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints

SummaryBefore Langflow 1.10.1, two deprecated but still-routed endpoints in the chat API did not check that the authenticated caller owns the flow referenced in the URL path:- POST /api/v1/build/flowid/vertices retrieveverticesorder- POST /api/v1/build/flowid/vertices/vertexid buildvertexAny...

Langflow : Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints

SummaryBefore Langflow 1.10.1, two deprecated but still-routed endpoints in the chat API did not check that the authenticated caller owns the flow referenced in the URL path:- POST /api/v1/build/flowid/vertices retrieveverticesorder- POST /api/v1/build/flowid/vertices/vertexid buildvertexAny...

PYSEC-2026-4223 Hydra instantiate target blacklist bypasses permit code execution

Summary Hydra's instantiate API resolves and invokes Python callables named by the target field in configuration. The target blacklist introduced for CVE-2026-68508 was incomplete. Representative bypasses included execution wrappers such as timeit.timeit, executable deserialization through...

PYSEC-2026-4237 Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration

Summary Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and before 1.10.3 wrapped in bash -c "exec command ...". Any user able to reach the MCP server settings "Settings → MCP Servers → Add MCP Server",...

PYSEC-2026-4221 Hydra logging configuration permits unsafe callable resolution

Summary Hydra passed its Python logging configuration to logging.config.dictConfig. Python's logging configurator can resolve and invoke importable classes and factories named by configuration, including handler class values and formatter, filter, handler, queue, and listener factories. This...

PYSEC-2026-4222 Hydra: Mutable instantiate policy sets allow target blocklist bypass

Summary Hydra's legacy instantiate target blocklists and related execution-policy collections are stored in mutable module-level state. Because locate can resolve attributes on imported objects, a configuration can resolve a mutation method such as .discard, modify the active policy, and then...

PYSEC-2026-4224 Hydra: Optuna custom_search_space can resolve and execute untrusted callables via get_method

Summary hydra-optuna-sweeper accepted a configuration-controlled dotted path in hydra.sweeper.customsearchspace, resolved it with the lower-level hydra.utils.getmethod API, and later invoked the returned callable. Hydra's object-lookup helpers intentionally trust their input and do not apply the...

Hydra logging configuration permits unsafe callable resolution

SummaryHydra passed its Python logging configuration to logging.config.dictConfig. Python's logging configurator can resolve and invoke importable classes and factories named by configuration, including handler class values and formatter, filter, handler, queue, and listener factories.This loggin...

WeasyPrint: EPS images reach the Ghostscript interpreter resulting in RCE

SummaryThis was found during a pentest, funded by the NLNnet foundation, conducted by Stefan Vink from Radically Open Security and the only High issue found. WeasyPrint passes fetched image bytes directly to Pillow's generic format dispatcher without restricting the input format. When Ghostscript...

Hydra instantiate target blacklist bypasses permit code execution

SummaryHydra's instantiate API resolves and invokes Python callables named by the target field in configuration. The target blacklist introduced for CVE-2026-68508 was incomplete.Representative bypasses included execution wrappers such as timeit.timeit, executable deserialization through...

Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration

SummaryBefore Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and before 1.10.3 wrapped in bash -c "exec command ...". Any user able to reach the MCP server settings "Settings → MCP Servers → Add MCP Server",...

Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration

SummaryBefore Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and before 1.10.3 wrapped in bash -c "exec command ...". Any user able to reach the MCP server settings "Settings → MCP Servers → Add MCP Server",...

Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration

SummaryBefore Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and before 1.10.3 wrapped in bash -c "exec command ...". Any user able to reach the MCP server settings "Settings → MCP Servers → Add MCP Server",...

PYSEC-2026-4241 Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration

Summary Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and before 1.10.3 wrapped in bash -c "exec command ...". Any user able to reach the MCP server settings "Settings → MCP Servers → Add MCP Server",...

Hydra: Optuna custom_search_space can resolve and execute untrusted callables via get_method

Summaryhydra-optuna-sweeper accepted a configuration-controlled dotted path inhydra.sweeper.customsearchspace, resolved it with the lower-levelhydra.utils.getmethod API, and later invoked the returned callable.Hydra's object-lookup helpers intentionally trust their input and do not applythe...

PYSEC-2026-4230 Langflow has Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers

Summary Langflow's project-scoped MCP transport authenticates the caller for the projectid in the connection URL, but the subsequent resources/read operation does not authorize the resource URI being requested. An authenticated user can connect to their own project-scoped MCP endpoint and supply ...

Langflow has Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers

SummaryLangflow's project-scoped MCP transport authenticates the caller for the projectid in the connection URL, but the subsequent resources/read operation does not authorize the resource URI being requested. An authenticated user can connect to their own project-scoped MCP endpoint and supply a...

Hydra: Mutable instantiate policy sets allow target blocklist bypass

SummaryHydra's legacy instantiate target blocklists and related execution-policycollections are stored in mutable module-level state. Because locate canresolve attributes on imported objects, a configuration can resolve a mutationmethod such as .discard, modify the active policy, and then...

PYSEC-2026-4311 WeasyPrint: EPS images reach the Ghostscript interpreter resulting in RCE

Summary This was found during a pentest, funded by the NLNnet foundation, conducted by Stefan Vink from Radically Open Security and the only High issue found. WeasyPrint passes fetched image bytes directly to Pillow's generic format dispatcher without restricting the input format. When Ghostscrip...

PYSEC-2026-4238 Langflow : Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints

Summary Before Langflow 1.10.1, two deprecated but still-routed endpoints in the chat API did not check that the authenticated caller owns the flow referenced in the URL path: - POST /api/v1/build/flowid/vertices retrieveverticesorder - POST /api/v1/build/flowid/vertices/vertexid buildvertex Any...