130 matches found
EUVD-2026-78164
IBM Langflow OSS 1.0.0 through 1.10.0 can allow attackers to execute arbitrary Python code with root privileges UID=0 on the Langflow server by submitting components containing socket or urllib imports. This enables: 1 AWS credential theft via IMDSv1 SSRF with full IAM role permissions, 2 arbitra...
CVE-2026-12944
IBM Langflow OSS 1.0.0 through 1.10.0 can allow attackers to execute arbitrary Python code with root privileges UID=0 on the Langflow server by submitting components containing socket or urllib imports. This enables: 1 AWS credential theft via IMDSv1 SSRF with full IAM role permissions, 2 arbitra...
CVE-2026-12944 Incomplete Security Scanner Blocklist Enables Network-Based Code Execution
IBM Langflow OSS 1.0.0 through 1.10.0 can allow attackers to execute arbitrary Python code with root privileges UID=0 on the Langflow server by submitting components containing socket or urllib imports. This enables: 1 AWS credential theft via IMDSv1 SSRF with full IAM role permissions, 2 arbitra...
CVE-2026-12763
IBM Langflow OSS 1.0.0 through 1.11.5 could allow an authenticated attacker to access another user's MCP server context due to improper cache key isolation in the MCP Tools component...
CVE-2026-12766
IBM Langflow OSS 1.0.0 through 1.11.2 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks...
CVE-2026-12767
IBM Langflow OSS 1.0.0 through 1.11.5 is vulnerable to server-side request forgery SSRF. This may allow an unauthenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks...
EUVD-2026-78087
IBM Langflow OSS 1.0.0 through 1.11.5 could allow an authenticated attacker to access another user's MCP server context due to improper cache key isolation in the MCP Tools component...
EUVD-2026-78086
IBM Langflow OSS 1.0.0 through 1.10.2 is vulnerable to server-side request forgery SSRF. This may allow an unauthenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks...
EUVD-2026-78084
IBM Langflow OSS 1.0.0 through 1.11.2 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks...
EUVD-2026-78083
IBM Langflow OSS 1.0.0 through 1.11.5 is vulnerable to server-side request forgery SSRF. This may allow an unauthenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks...
PT-2026-91736
IBM Langflow OSS 1.0.0 through 1.10.0 can allow attackers to execute arbitrary Python code with root privileges UID=0 on the Langflow server by submitting components containing socket or urllib imports. This enables: 1 AWS credential theft via IMDSv1 SSRF with full IAM role permissions, 2 arbitra...
CVE-2026-9198
CVE-2026-9198 - IBM Langflow RCE no autenticado mediante bypass de auto-login PoC educativo Este repositorio proporciona una prueba de concepto educativa para CVE-2026-9198 que afecta a IBM Langflow OSS. El PoC poc.py demuestra cómo un atacante no autenticado puede encadenar: 1. GET/POST...
CVE-2026-9198
CVE-2026-9198 - IBM Langflow OSS Unauthenticated Remote Code Execution RCE Critical unauthenticated remote code execution vulnerability affecting IBM Langflow OSS. The vulnerability results from chaining two weaknesses: 1. /api/v1/autologin can issue a privileged SUPERUSER bearer token to an...
EXPLOIT-CVE-2026-9198
CVE-2026-9198 — IBM Langflow OSS Unauthenticated RCE Proof-of-concept exploit and a self-contained Docker lab for CVE-2026-9198 , an unauthenticated remote code execution vulnerability in IBM Langflow OSS. The exploit chains two endpoints — autologin which hands out a SUPERUSER token to anyone an...
CVE-2026-9198
CVE-2026-9198 Vulnerability cause: IBM Langflow OSS is an open-source software specifically used for building and deploying Agent automation workflows. IBM Langflow OSS from 1.0.0 to 1.10.0 has automatic login enabled by default autologin is true. In this mode, accessing the /api/v1/autologin...
CVE-2026-9198
🚨 CVE-2026-9198 IBM Langflow OSS 未经身份验证的远程代码执行（通过自动登录绕过） 📋 概述 CVE-2026-9198 是 IBM Langflow OSS 中的一个关键未经身份验证的远程代码执行漏洞。该利用程序链式利用了以下两个漏洞： CVE-2026-9103 ：自动登录绕过，允许未经身份验证的调用者获取超级用户 JWT 令牌 CVE-2026-8481 ：/api/v1/validate/code 端点中的代码注入，允许任意 Python 执行 ⚠️ 警告 ：此工具仅用于授权的安全测试和教育目的。未经授权的使用是非法的。 🚀 特性 🔓 自动登录绕过 —...
EUVD-2026-75761
IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to improper limitation of a pathname to a restricted directory...
EUVD-2026-75777
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute flows and obtain sensitive information due to insufficient session expiration of API keys after user deactivation...