201 matches found
EXPLOIT-CVE-2026-9198
CVE-2026-9198 — IBM Langflow OSS 未认证远程代码执行 针对 CVE-2026-9198 的概念验证漏洞利用程序及自包含 Docker 实验环境，该漏洞是 IBM Langflow OSS 中的一个未认证远程代码执行漏洞。 该漏洞利用程序串联两个端点——autologin（向任何人发放 SUPERUSER 令牌）和 validate/code（运行攻击者提供的 Python 代码）——以 Langflow 服务用户身份实现代码执行，无需任何凭据 。 !WARNING 仅限授权的安全测试和教育用途。...
CVE-2026-9198
CVE-2026-9198 漏洞原因： IBM Langflow OSS是一个专门用于构建和部署Agent自动化工作流的开源软件 IBM Langflow OSS 1.0.0 到 1.10.0默认开启了自动登录（autologin 为true） 这个模式下访问/api/v1/autologin端点会直接返还超级用户token令牌 使用这个令牌可以访问/api/v1/validate/code端点 POST /api/v1/validate/code这是一个验证端点，但会对提交的源代码中的每个函数定义validatecode进行编译和exec 验证...
CVE-2026-9198
🚨 CVE-2026-9198 IBM Langflow OSS 未经身份验证的远程代码执行（通过自动登录绕过） 📋 概述 CVE-2026-9198 是 IBM Langflow OSS 中的一个关键未经身份验证的远程代码执行漏洞。该利用程序链式利用了以下两个漏洞： CVE-2026-9103 ：自动登录绕过，允许未经身份验证的调用者获取超级用户 JWT 令牌 CVE-2026-8481 ：/api/v1/validate/code 端点中的代码注入，允许任意 Python 执行 ⚠️ 警告 ：此工具仅用于授权的安全测试和教育目的。未经授权的使用是非法的。 🚀 特性 🔓 自动登录绕过 —...
EUVD-2026-75761
IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to improper limitation of a pathname to a restricted directory...
EUVD-2026-75777
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute flows and obtain sensitive information due to insufficient session expiration of API keys after user deactivation...
EUVD-2026-75771
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special characters in flow display names...
EUVD-2026-75780
IBM Langflow OSS 1.0.0 through 1.11.5 allows an authenticated non-administrative user could execute arbitrary operating system commands on the server at the privilege level of the application process by constructing a flow with an MCP Tools component configured to use a local stdio subprocess...
EUVD-2026-75779
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to obtain sensitive information from internal network resources due to improper validation of user-supplied URLs...
EUVD-2026-75792
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to an incomplete environment variable blocklist...
EUVD-2026-75794
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to execute arbitrary OS commands due to improper neutralization of special elements used in an OS command...
EUVD-2026-75795
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-controlled API endpoints...
EUVD-2026-75800
IBM Langflow OSS 1.0.0 through 1.11.5 could allow an authenticated attacker to execute arbitrary code due to an incomplete denylist in the security scanner...
EUVD-2026-75793
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to read arbitrary files due to improper access control...
EUVD-2026-75799
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to an unguarded eval call on attacker-controlled input...
CVE-2026-84889
IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to improper limitation of a pathname to a restricted directory...
CVE-2026-84889
IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to improper limitation of a pathname to a restricted directory...
CVE-2026-81940
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special characters in flow display names...
CVE-2026-81213
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to obtain sensitive information from internal network resources due to improper validation of user-supplied URLs...
CVE-2026-81268
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute flows and obtain sensitive information due to insufficient session expiration of API keys after user deactivation...