IBM: 16 Vulnerabilities Across Products, Critical Flaws in Langflow OSS Revealed
IBM disclosed 16 vulnerabilities across multiple products, including critical flaws in Langflow OSS allowing code execution and privilege escalation.
Key findings
- 16 vulnerabilities disclosed across multiple IBM products on August 28, 2026.
- IBM Langflow OSS is heavily impacted with eight vulnerabilities, including critical code execution flaws (CVE-2026-19295, CVE-2026-19286).
- Critical vulnerabilities in Langflow OSS allow for OS command injection, SQL injection, and arbitrary code execution.
- IBM Administration Runtime Expert for i has a critical privilege escalation vulnerability (CVE-2026-18527).
- Affected versions for Langflow OSS range from 1.0.0 through 1.11.1.
- Vulnerabilities include code execution, SQLi, path traversal, SSRF, and DoS across various IBM products.
On August 28, 2026, a significant batch of 16 vulnerabilities was disclosed across multiple IBM products, with a particular focus on IBM Langflow OSS. This coordinated disclosure event highlights critical security weaknesses that could allow for arbitrary code execution, SQL injection, and denial of service. The vulnerabilities span several IBM offerings, including IBM Cloud Pak for Data System, IBM Concert, IBM Langflow OSS, IBM Administration Runtime Expert for i, IBM AIX, IBM PowerVM VIOS, and IBM Integrated Analytics System.
IBM Langflow OSS is the most heavily impacted product in this batch, with eight vulnerabilities disclosed. Among these, CVE-2026-19295 stands out with a critical CVSSv3 score of 9.9, allowing an authenticated attacker to execute arbitrary operating system commands. CVE-2026-19286, also critical (CVSSv3 9.8), enables remote attackers to execute arbitrary code due to improper security restrictions on the A2A public endpoint. Further critical vulnerabilities in Langflow OSS include CVE-2026-19294 (SQL injection, CVSSv3 9.1) and CVE-2026-18729 (arbitrary code execution, CVSSv3 8.8). High-severity flaws in Langflow OSS include CVE-2026-18891 (arbitrary flow execution and sensitive information access, CVSSv3 8.2), CVE-2026-18904 (sensitive information disclosure and unauthorized message injection, CVSSv3 8.2), CVE-2026-18899 (arbitrary file reading via path traversal, CVSSv3 7.5), and CVE-2026-18545 (server-side request forgery, CVSSv3 4.3).
Beyond Langflow OSS, other IBM products are affected by this disclosure. IBM Administration Runtime Expert for i is vulnerable to CVE-2026-18527, a critical flaw (CVSSv3 9.9) that could allow an unauthenticated attacker to execute actions under another user's authenticated profile, leading to elevated privileges. CVE-2026-17203 in the same product allows authenticated attackers to obtain sensitive information due to improper authentication enforcement (CVSSv3 7.5). IBM AIX and IBM PowerVM VIOS are impacted by CVE-2026-16821, a high-severity vulnerability (CVSSv3 7.0) that could allow a local attacker to gain elevated privileges due to a format string vulnerability. IBM Concert faces CVE-2026-3627 (SQL injection, CVSSv3 9.1) and CVE-2025-64649 (unauthorized actions via man-in-the-middle due to improper certificate validation, CVSSv3 5.9). IBM Cloud Pak for Data System has CVE-2026-3686, a medium-severity denial of service vulnerability (CVSSv3 6.2). Lastly, IBM Integrated Analytics System is affected by CVE-2025-36290 and CVE-2025-36271, both medium-severity flaws (CVSSv3 5.9) related to improper TLS certificate validation and the use of weaker cryptographic algorithms, respectively.
The vulnerabilities in IBM Langflow OSS, versions 1.0.0 through 1.11.1, present a severe risk, with multiple critical flaws allowing for arbitrary code execution and command injection. The related news coverage from Vypr Intelligence specifically highlights these eight vulnerabilities in Langflow OSS, noting that affected versions range from 1.0.0 to 1.11.1 and urging immediate updates. While specific patch details for each individual CVE are not provided in the input, the common version ranges across the Langflow OSS vulnerabilities suggest that updating to a later version released after 1.11.1 would likely address these issues. Users of affected IBM products are strongly advised to consult IBM's official security advisories and apply necessary patches or updates promptly to mitigate these risks.
This broad disclosure underscores the importance of regular security assessments across IBM's diverse product portfolio. The concentration of critical and high-severity vulnerabilities in Langflow OSS warrants immediate attention from organizations utilizing this platform. The varied nature of the vulnerabilities, from code execution to denial of service and information disclosure, necessitates a comprehensive review of security postures for all affected IBM products. Staying informed about vendor security bulletins and applying timely updates remains the most effective defense against such widespread vulnerability disclosures.