Langflow Oss (Ibm) - vulnerabilities (CVEs)

142 CVEs, 25 in the last 30 days, 15 known versions, newest CVE from 2026-10-19. Vendor: Ibm.

CVEs of Langflow Oss

CVE-2026-107366 - CVSS 8.3 (high), 2026-10-19: IBM Langflow OSS 1.0.0 through 1.12.4 contains three message endpoints that perform no ownership verification. Any authenticated user can bulk-delete another…
CVE-2026-88962 - CVSS 8.8 (high), 2026-10-07: IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code generation.
CVE-2026-93443 - CVSS 8.8 (high), 2026-10-07: IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements…
CVE-2026-93448 - CVSS 6.5 (medium), 2026-10-07: IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to…
CVE-2026-93449 - CVSS 8.8 (high), 2026-10-07: IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code generation.
CVE-2026-93445 - CVSS 8.8 (high), 2026-10-07: IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code.
CVE-2026-93447 - CVSS 7.5 (high), 2026-10-07: IBM Langflow OSS 1.0.0 through 1.12.2 could allow an attacker with access to the server secret and Redis write access to submit a malicious serialized cache…
CVE-2026-93675 - CVSS 9.8 (critical), 2026-10-07: IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to an expected dependency confusion.
CVE-2026-93677 - CVSS 7.7 (high), 2026-10-07: IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to exposure of sensitive information to…
CVE-2026-93678 - CVSS 7.6 (high), 2026-10-07: IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization.
CVE-2026-93679 - CVSS 4.3 (medium), 2026-10-07: IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to cause a denial of service due to uncontrolled resource consumption during…
CVE-2026-93674 - CVSS 9.8 (critical), 2026-10-07: IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS…
CVE-2026-97671 - CVSS 6.5 (medium), 2026-10-07: IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to a path traversal vulnerability.
CVE-2026-97673 - CVSS 8.8 (high), 2026-10-07: IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper input validation.
CVE-2026-97674 - CVSS 8.1 (high), 2026-10-06: IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary OS commands due to improper neutralization of special…
CVE-2026-97678 - CVSS 8.8 (high), 2026-10-06: IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper input validation.
CVE-2026-97679 - CVSS 8.8 (high), 2026-10-06: IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements…
CVE-2026-97680 - CVSS 8.3 (high), 2026-10-06: IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information or inject malicious data due to improper…
CVE-2026-97655 - CVSS 8.8 (high), 2026-10-06: IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to an incomplete blocklist in the code security scanner.
CVE-2026-97676 - CVSS 8.8 (high), 2026-10-06: IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements…
CVE-2026-101329 - CVSS 6.5 (medium), 2026-10-06: IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper access control.
CVE-2026-101331 - CVSS 7.7 (high), 2026-10-06: IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to insufficiently protected credentials.
CVE-2026-103360 - CVSS 8.1 (high), 2026-10-06: IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to…
CVE-2026-104334 - CVSS 9.8 (critical), 2026-10-06: IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper control of code generation.
CVE-2026-104335 - CVSS 8.8 (high), 2026-10-06: IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper access control.
CVE-2026-12944 - CVSS 9.6 (critical), 2026-09-14: IBM Langflow OSS 1.0.0 through 1.10.0 can allow attackers to execute arbitrary Python code with root privileges (UID=0) on the Langflow server by submitting…
CVE-2026-12763 - CVSS 4.2 (medium), 2026-09-14: IBM Langflow OSS 1.0.0 through 1.11.5 could allow an authenticated attacker to access another user's MCP server context due to improper cache key isolation in…
CVE-2026-12765 - CVSS 6.5 (medium), 2026-09-14: IBM Langflow OSS 1.0.0 through 1.10.2 is vulnerable to server-side request forgery (SSRF). This may allow an unauthenticated attacker to send unauthorized…
CVE-2026-12766 - CVSS 5.4 (medium), 2026-09-14: IBM Langflow OSS 1.0.0 through 1.11.2 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized…
CVE-2026-12767 - CVSS 6.5 (medium), 2026-09-14: IBM Langflow OSS 1.0.0 through 1.11.5 is vulnerable to server-side request forgery (SSRF). This may allow an unauthenticated attacker to send unauthorized…
CVE-2026-17628 - CVSS 5.4 (medium), 2026-09-14: IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to change the password of an account due to improper authentication.
CVE-2026-76059 - CVSS 8.8 (high), 2026-09-10: IBM Langflow OSS 1.0.0 through 1.11.5 An attacker who could submit custom component source code could bypass the static security scanner by crafting an…
CVE-2026-78569 - CVSS 8.8 (high), 2026-09-10: IBM Langflow OSS 1.0.0 through 1.11.5 could allow an authenticated attacker to execute arbitrary code due to an incomplete denylist in the security scanner.
CVE-2026-78571 - CVSS 8.8 (high), 2026-09-10: IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to an unguarded eval() call on…
CVE-2026-78575 - CVSS 8.8 (high), 2026-09-10: IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary commands due to improper validation of command-line…
CVE-2026-79723 - CVSS 5 (medium), 2026-09-10: IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of…
CVE-2026-79724 - CVSS 9.8 (critical), 2026-09-10: IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to execute arbitrary OS commands due to improper neutralization of special elements used…
CVE-2026-79725 - CVSS 6.5 (medium), 2026-09-10: IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to read arbitrary files due to improper access control.
CVE-2026-79742 - CVSS 8.8 (high), 2026-09-10: IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to an incomplete environment variable blocklist.
CVE-2026-81204 - CVSS 9.8 (critical), 2026-09-10: IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to execute arbitrary code due to code injection during graph construction.
CVE-2026-81211 - CVSS 8.8 (high), 2026-09-10: IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary Python code due to improper authorization of custom…
CVE-2026-81941 - CVSS 8.8 (high), 2026-09-10: IBM Langflow OSS 1.0.0 through 1.11.5 allows an authenticated non-administrative user could execute arbitrary operating system commands on the server at the…
CVE-2026-81213 - CVSS 8.6 (high), 2026-09-10: IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to obtain sensitive information from internal network resources due to improper validation…
CVE-2026-81265 - CVSS 7.5 (high), 2026-09-10: IBM Langflow OSS 1.0.0 through 1.11.5.
CVE-2026-81268 - CVSS 8.1 (high), 2026-09-10: IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute flows and obtain sensitive information due to insufficient…
CVE-2026-81940 - CVSS 8.8 (high), 2026-09-10: IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special…
CVE-2026-84889 - CVSS 8.8 (high), 2026-09-10: IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to improper limitation of a pathname to a…
CVE-2026-85025 - CVSS 9.8 (critical), 2026-09-10: IBM Langflow OSS 1.0.0 through 1.11.5 Langflow could allow an unauthenticated attacker to execute arbitrary code and access or modify chat sessions through…
CVE-2026-9225 - CVSS 6.5 (medium), 2026-09-10: IBM Langflow OSS 1.0.0 through 1.11.5 Langflow could allow an authenticated attacker to access sensitive files belonging to other users due to improper access…
CVE-2026-14470 - CVSS 6.5 (medium), 2026-09-04: IBM Langflow OSS 1.0.0 through 1.10.2 could allow an authenticated attacker to traverse directories on the system. An attacker could send a specially crafted…
CVE-2026-17627 - CVSS 7.1 (high), 2026-09-04: IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information and inject messages into workflow history…
CVE-2026-17621 - CVSS 5.4 (medium), 2026-09-04: IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL…
CVE-2026-17622 - CVSS 6.5 (medium), 2026-09-04: IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to…
CVE-2026-17631 - CVSS 6.5 (medium), 2026-09-04: IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery (SSRF)…
CVE-2026-19298 - CVSS 8.8 (high), 2026-09-04: IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to execute arbitrary code due to an authorization bypass in the flow build…
CVE-2026-19301 - CVSS 6.5 (medium), 2026-09-04: IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.
CVE-2026-19303 - CVSS 8.1 (high), 2026-09-04: IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to delete arbitrary local files or directories due to improper limitation of…
CVE-2026-19300 - CVSS 7.5 (high), 2026-09-04: IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote attacker to obtain sensitive information due to incomplete scrubbing of sensitive credential fields.
CVE-2026-19299 - CVSS 6.5 (medium), 2026-09-04: IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to path traversal.
CVE-2026-19302 - CVSS 6.5 (medium), 2026-09-04: IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of symbolic links.
CVE-2026-19304 - CVSS 7.7 (high), 2026-09-04: IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information from internal services due to a URL parser…
CVE-2026-19305 - CVSS 8.6 (high), 2026-09-04: IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery.
CVE-2026-19306 - CVSS 7.7 (high), 2026-09-04: IBM Langflow OSS 1.0.0 through 1.11.2 allows an authenticated attacker to read arbitrary files from the server filesystem — including server secret material…
CVE-2026-9138 - CVSS 6.5 (medium), 2026-09-04: IBM Langflow OSS 1.0.0 through 1.11.2 Langflow could allow an authenticated attacker to write arbitrary files to the server due to improper input validation…
CVE-2026-8447 - CVSS 6.1 (medium), 2026-09-04: IBM Langflow OSS 1.0.0 through 1.11.2 suffer from a stored cross-site scripting vulnerability in the Playground chat interface.
CVE-2026-9186 - CVSS 6.5 (medium), 2026-09-04: IBM Langflow OSS 1.0.0 through 1.11.2 allows remote authenticated attackers to bypass localhost-only MCP configuration installation by spoofing…
CVE-2026-19295 - CVSS 9.9 (critical), 2026-08-28: IBM Langflow OSS 1.0.0 through 1.11.1 allows an authenticated attacker to execute arbitrary operating system commands in the server process by saving a flow…
CVE-2026-19294 - CVSS 6.5 (medium), 2026-08-28: IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote authenticated attacker to execute and read any user's private flow due to improper authorization.
CVE-2026-19286 - CVSS 9.8 (critical), 2026-08-28: IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary code due to improper enforcement of security restrictions on the A2A…
CVE-2026-18904 - CVSS 8.2 (high), 2026-08-28: IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to obtain sensitive information and inject unauthorized messages due to a namespace…
CVE-2026-18899 - CVSS 7.5 (high), 2026-08-28: IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to read arbitrary files due to path traversal.
CVE-2026-18891 - CVSS 8.2 (high), 2026-08-28: IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary flows and access sensitive information due to improper authentication.
CVE-2026-18729 - CVSS 8.8 (high), 2026-08-28: IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code.
CVE-2026-18545 - CVSS 4.3 (medium), 2026-08-28: IBM Langflow OSS 1.0.0 through 1.11.1 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized…
CVE-2026-19297 - CVSS 9.1 (critical), 2026-08-13: IBM Langflow OSS 1.0.0 through 1.9.6 could allow a remote attacker to obtain unauthorized access to user accounts due to improper restriction of excessive…
CVE-2026-17624 - CVSS 8.8 (high), 2026-08-05: IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0…
CVE-2026-17633 - CVSS 8.8 (high), 2026-08-05: IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to code injection.
CVE-2026-17632 - CVSS 8.8 (high), 2026-08-05: IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of Python code during…
CVE-2026-9196 - CVSS 8.8 (high), 2026-08-05: IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute unintended code during Agentic Assistant validation due to improper…
CVE-2026-8182 - CVSS 8.8 (high), 2026-08-05: IBM Langflow OSS 1.0.0 through 1.10.3 installations allow anyone on the internet to execute arbitrary code on the server without any credentials via 2 HTTP…
CVE-2026-9201 - CVSS 8.8 (high), 2026-08-05: IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute arbitrary code due to a cryptographic weakness in the custom component…
CVE-2026-8478 - CVSS 8.8 (high), 2026-08-05: IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote attacker to inject arbitrary code on the system, due to the improper control of user input code.
CVE-2026-8183 - CVSS 7.7 (high), 2026-08-05: IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 could…
CVE-2026-7658 - CVSS 6.5 (medium), 2026-08-05: IBM Langflow OSS 1.0.0 through 1.10.3 does not properly validate the username field, allowing attackers to inject path traversal sequences and bypass…
CVE-2026-9130 - CVSS 7.1 (high), 2026-08-05: IBM Langflow OSS 1.0.0 through 1.10.3 contain an authorization bypass vulnerability in the MemoryComponent that allows authenticated users to access chat…
CVE-2026-10547 - CVSS 8.1 (high), 2026-08-05: IBM Langflow OSS 1.0.0 through 1.10.3 does not properly validate ownership in the deprecated POST /api/v1/build/{flow_id}/vertices endpoint, allowing an…
CVE-2026-7869 - CVSS 5.4 (medium), 2026-08-05: IBM Langflow OSS 1.0.0 through 1.10.3 is vulnerable to Path Traversal in the Knowledge Bases API (`POST /api/v1/knowledge_bases`). This occurs because…
CVE-2026-8470 - CVSS 9.1 (critical), 2026-08-05: IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 use Python's non-cryptographic random module for…
CVE-2026-9205 - CVSS 9.8 (critical), 2026-08-05: IBM Langflow OSS contains a weak cryptographic key derivation vulnerability in the ensure_fernet_key() function.
CVE-2026-10128 - CVSS 6.5 (medium), 2026-08-05: IBM Langflow OSS 1.0.0 through 1.10.3 allows authenticated users can exploit a built-in Langflow component to read arbitrary server environment variables,…
CVE-2026-9081 - CVSS 7.1 (high), 2026-08-05: IBM Langflow OSS 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 contains a Server-Side Request Forgery (SSRF) vulnerability in the…
CVE-2026-7657 - CVSS 6.5 (medium), 2026-08-05: IBM Langflow OSS 1.0.0 through 1.10.3 Langflow could allow server-side request forgery (SSRF) due to incomplete and ineffective SSRF protection enforcement.
CVE-2026-17625 - CVSS 8.8 (high), 2026-08-05: IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0…
CVE-2026-17623 - CVSS 8.8 (high), 2026-08-05: IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper validation of the command…
CVE-2026-17630 - CVSS 8.8 (high), 2026-08-05: IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote attacker to execute arbitrary code due to improper validation of configuration parameters.
CVE-2026-17626 - CVSS 8.8 (high), 2026-08-05: IBM Langflow OSS 1.0.0 through 1.10.3 Langflow could allow an authenticated attacker to read, modify, or expose sensitive host files via Docker-based MCP…
CVE-2026-8446 - CVSS 7.5 (high), 2026-08-05: IBM Langflow OSS 1.0.0 through 1.10.3 contain an authentication bypass vulnerability in the Model Context Protocol (MCP) composer endpoint when…
CVE-2026-7646 - CVSS 6.5 (medium), 2026-08-05: IBM Langflow OSS 1.0.0 through 1.10.3 allows users to read arbitrary files from the server filesystem, including other users' uploaded documents, the JWT…
CVE-2026-9077 - CVSS 8.5 (high), 2026-08-05: IBM Langflow OSS 1.0.0 through 1.10.3 Langflow allows remote authenticated attackers to bypass localhost-only restrictions and write arbitrary MCP server…
CVE-2026-12946 - CVSS 9.9 (critical), 2026-07-30: IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to inject arbitrary code on the system, due to the improper control of user input code.