CVE-2026-18729

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code...

CVE-2026-18545

IBM Langflow OSS 1.0.0 through 1.11.1 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks...

CVE-2026-18891

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary flows and access sensitive information due to improper authentication...

CVE-2026-18891

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary flows and access sensitive information due to improper authentication...

CVE-2026-18729

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code...

CVE-2026-19295 Langflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcement

IBM Langflow OSS 1.0.0 through 1.11.1 allows an authenticated attacker to execute arbitrary operating system commands in the server process by saving a flow with a crafted type field value and triggering a build of a wrapper flow that references it. This allowed privilege escalation from...

CVE-2026-19286

IBM Langflow OSS versions 1.0.0 through 1.11.1 are vulnerable to arbitrary code execution via the A2A (Agent-to-Agent) public endpoint . The root cause is that the A2A public execution path does not invoke the validate_public_flow_no_code_execution guard used by other unauthenticated public surfa...

CVE-2026-18899

IBM Langflow OSS 1.0.0 through 1.11.1 is vulnerable to a path traversal (CWE-22) that allows an unauthenticated remote attacker to read arbitrary files. The root cause is in the public flow-build endpoint, which accepts an unvalidated files parameter forwarded directly to the storage backend; the...

CVE-2026-18891

IBM Langflow OSS versions 1.0.0 through 1.11.1 is affected by an improper authentication flaw (CWE-287) in the MCP project authentication function. When MCP Composer is enabled, the function omits the default auth_type=none value from the set of modes requiring an API key, causing unauthenticated...

PT-2026-83332

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary code due to improper enforcement of security restrictions on the A2A public endpoint...

Security Bulletin: Langflow OSS is affected by server-side request forgery in provider validation and API request functionality

Summary Langflow OSS includes outbound network request functionality for provider validation and API request execution. Weaknesses in request destination validation and enforcement could allow authenticated users to induce requests to unintended internal or external network locations, which may...

Security Bulletin: Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement

Summary Langflow OSS supports custom Python components and validation of component code for component development workflows. Weaknesses in custom component execution paths, validation endpoints, and trusted template enforcement could allow authenticated users to execute arbitrary Python code or...

Security Bulletin: Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation

Summary A vulnerability allowed unauthenticated attackers to achieve remote code execution on default-configured instances. The vulnerability combined two distinct issues: an unauthenticated endpoint that issued superuser bearer tokens to any network caller, and a code validation endpoint that...

Security Bulletin: Code Injection Vulnerability in Code Validation Endpoint

Summary A code injection vulnerability was identified in the code validation endpoint that allowed authenticated users to execute arbitrary code on the server. The vulnerability existed in the validation logic which compiled and executed function definitions to check for import errors. Attackers...

Security Bulletin: Insufficient Authentication Brute Force Protection on Login Endpoint

Summary A rate limiting capability exists within the product to restrict the number of authentication attempts permitted per IP address per minute against the login endpoint POST /api/v1/login. This control is configurable via the LANGFLOWRATELIMITENABLED environment variable, which defaults to...

EUVD-2026-53577

IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to code injection...

CVE-2026-7658 Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement

IBM Langflow OSS 1.0.0 through 1.10.3 does not properly validate the username field, allowing attackers to inject path traversal sequences and bypass containment checks. This enables multiple severe impacts, including arbitrary directory deletion, cross-tenant data destruction, and JWT signing ke...

CVE-2026-10547

IBM Langflow OSS 1.0.0 through 1.10.3 does not properly validate ownership in the deprecated POST /api/v1/build/flowid/vertices endpoint, allowing an authenticated user to inject arbitrary graph data into a shared cache for any flow. This may result in cross-user cache pollution, unauthorized...

CVE-2026-7869 Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement

IBM Langflow OSS 1.0.0 through 1.10.3 is vulnerable to Path Traversal in the Knowledge Bases API POST /api/v1/knowledgebases. This occurs because user-supplied knowledge base names are used directly to create file paths without proper sanitization or containment checks. An authenticated attacker...

CVE-2026-9081 Langflow OSS is affected by server-side request forgery in provider validation and API request functionality

IBM Langflow OSS 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 contains a Server-Side Request Forgery SSRF vulnerability in the validatemodelproviderkey function for the Ollama provider. The function accepts a user-supplied OLLAMABASEURL parameter and passes it directly to requests.get without...