IBM Langflow OSS: Critical RCE and Six Other Flaws Disclosed Together
Six vulnerabilities, including a critical RCE flaw, were disclosed for IBM Langflow OSS on September 14, 2026, impacting versions 1.0.0 through 1.11.5.
Key findings
- Critical arbitrary Python code execution flaw (CVE-2026-12944) allows root access and credential theft.
- Multiple Server-Side Request Forgery (SSRF) vulnerabilities (CVE-2026-12767, CVE-2026-12766, CVE-2026-12765) disclosed together.
- Password change vulnerability (CVE-2026-17628) affects authenticated users.
- Improper cache isolation (CVE-2026-12763) could lead to unauthorized context access.
- All six vulnerabilities disclosed on September 14, 2026, for IBM Langflow OSS have patches available.
On September 14, 2026, a batch of six vulnerabilities was disclosed for IBM's Langflow OSS, with a critical-severity flaw allowing arbitrary Python code execution with root privileges. This disclosure event highlights significant security risks within the platform, particularly concerning code injection and server-side request forgery.
Several vulnerabilities center around Server-Side Request Forgery (SSRF). CVE-2026-12767 and CVE-2026-12763, affecting versions up to 1.11.5 and 1.11.2 respectively, allow unauthenticated and authenticated attackers to send unauthorized requests from the Langflow server. This could lead to network enumeration and further exploitation. CVE-2026-12765, impacting versions up to 1.10.2, also presents an SSRF risk to unauthenticated users.
The most severe vulnerability, CVE-2026-12944, carries a CVSSv3 score of 9.6 and affects Langflow OSS versions 1.0.0 through 1.10.0. It permits attackers to execute arbitrary Python code with root privileges by submitting components with socket or urllib imports. This specific flaw enables critical actions such as AWS credential theft via IMDSv1 SSRF with full IAM role permissions and arbitrary file exfiltration.
Additionally, CVE-2026-17628, affecting versions up to 1.10.2, allows a remote authenticated attacker to change an account's password due to improper authentication. Another medium-severity vulnerability, CVE-2026-12763, involves improper cache key isolation in the MCP Tools component, potentially allowing authenticated attackers to access other users' MCP server contexts.
IBM has released patches for these vulnerabilities. Users are strongly advised to update to the latest versions of Langflow OSS to mitigate these risks. The timely disclosure and patching of these issues are crucial for maintaining the security and integrity of systems utilizing IBM Langflow OSS.
The batch of vulnerabilities disclosed on September 14, 2026, underscores the importance of secure coding practices and regular security audits for platforms like Langflow OSS, especially given the critical nature of the code execution and SSRF flaws. Users should prioritize applying the available patches to prevent potential compromise.