Exploit for Code Injection in Langflow

CVE-2025-3248 — Langflow Unauthenticated Remote Code Execution...

PT-2026-83327

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.11.1 Description An authenticated attacker can perform server-side request forgery SSRF, a flaw that allows the system to be coerced into making unauthorized requests. This can be used for network...

PT-2026-83328

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.11.1 Description Remote authenticated attackers can execute arbitrary code due to improper control over the generation of code. Recommendations At the moment, there is no information about a newer...

PT-2026-83332

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.11.1 Description Improper enforcement of security restrictions on the 'A2A' public endpoint allows a remote attacker to execute arbitrary code. Arbitrary code execution occurs when an attacker can run...

PT-2026-83329

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.11.1 Description Improper authentication allows a remote attacker to execute arbitrary flows and access sensitive information. Recommendations Update IBM Langflow OSS to a version later than 1.11.1...

PT-2026-83330

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.11.1 Description A path traversal issue exists that could allow a remote attacker to read arbitrary files from the system. Path traversal is a flaw that allows an attacker to access files and directori...

PT-2026-83331

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to obtain sensitive information and inject unauthorized messages due to a namespace collision between user identifiers...

PT-2026-83333

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote authenticated attacker to execute and read any user's private flow due to improper authorization...

CVE-2026-19295: Improper Neutralization of Directives in Dynamically Evaluated Code

IBM Langflow OSS 1.0.0 through 1.11.1 allows an authenticated attacker to execute arbitrary operating system commands in the server process by saving a flow with a crafted type field value and triggering a build of a wrapper flow that references it. This allowed privilege escalation from...

CVE-2026-19286: Improper Control of Generation of Code

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary code due to improper enforcement of security restrictions on the A2A public endpoint...

CVE-2026-19294: Authorization Bypass Through User-Controlled Key

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote authenticated attacker to execute and read any user's private flow due to improper authorization...

CVE-2026-18899: Improper Limitation of a Pathname to a Restricted Directory

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to read arbitrary files due to path traversal...

CVE-2026-18904: Authorization Bypass Through User-Controlled Key

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to obtain sensitive information and inject unauthorized messages due to a namespace collision between user identifiers...

CVE-2026-18891: Improper Authentication

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary flows and access sensitive information due to improper authentication...

CVE-2026-18729: Improper Control of Generation of Code

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code...

CVE-2026-18545: Server-Side Request Forgery (SSRF)

IBM Langflow OSS 1.0.0 through 1.11.1 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks...

Langflow AI authenticated RCE

Langflow versions 1.11.1 and below are susceptible to authenticated remote code execution. By saving a flow where data.type is empty, an authenticated user can bypass the flow guard and execute arbitrary Python code. Module Options msf use exploit/multi/http/langflow/authrcecve202619295 msf...

Langflow AI Custom Component Authenticated RCE

Langflow versions 1.0.0 through 1.11.1 are susceptible to authenticated remote code execution due to improper enforcement of security restrictions of code generation on the /api/v1/customcomponent endpoint. The endpoint accepts attacker controlled code that is then passed to Python's exec functio...

Security Bulletin: Langflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulnerabilities

Summary Langflow contains multiple vulnerabilities in its authentication, authorization, and network request controls across several API surfaces. The MCP project authentication function omits the default authtype=none value from the set of modes requiring an API key, causing unauthenticated...

Security Bulletin: Langflow is affected by security vulnerabilities in Model Context Protocol features

Summary Langflow uses Model Context Protocol MCP features to manage external server connections, project access, file resources, and local client integration. Weaknesses in MCP command and configuration validation, authentication and authorization enforcement, file resource handling, and request...