IBM Langflow OSS: Eight Vulnerabilities Including Critical Code Execution Flaws Disclosed Together
Eight vulnerabilities, including critical flaws allowing arbitrary code execution and OS command injection, were disclosed for IBM Langflow OSS versions 1.0.0-1.11.1.
Key findings
- Eight vulnerabilities disclosed simultaneously for IBM Langflow OSS, impacting versions 1.0.0 through 1.11.1.
- Critical flaws include arbitrary code execution and OS command injection, with CVSS scores up to 9.9.
- Vulnerabilities also permit unauthorized access to private flows, file reading, and sensitive information disclosure.
- Path traversal, SSRF, and namespace collision issues compound the security risks.
- All affected versions range from 1.0.0 to 1.11.1; users should update immediately.
On August 28, 2026, a batch of eight vulnerabilities was disclosed for IBM's Langflow OSS, with several critical and high-severity flaws impacting versions 1.0.0 through 1.11.1. These vulnerabilities collectively expose users to risks including arbitrary code execution, privilege escalation, and sensitive data exposure. The disclosures highlight significant security weaknesses within the platform's handling of user flows and endpoint security.
Several critical vulnerabilities allow for arbitrary code execution. CVE-2026-19286, with a CVSSv3 score of 9.8, stems from improper enforcement of security restrictions on the A2A public endpoint. Additionally, CVE-2026-19295 (CVSSv3 9.9) enables an authenticated attacker to execute arbitrary operating system commands by crafting a flow with a specific type field and triggering its build. Another critical flaw, CVE-2026-18729 (CVSSv3 8.8), allows authenticated attackers to execute arbitrary code due to improper control over code generation.
Further compromising security, CVE-2026-19294 (CVSSv3 6.4) permits a remote authenticated attacker to read any user's private flow due to insufficient authorization checks. CVE-2026-18891 (CVSSv3 8.2) allows remote attackers to execute arbitrary flows and access sensitive information, also attributed to improper authentication. Path traversal vulnerabilities are also present, with CVE-2026-18899 (CVSSv3 7.5) enabling remote attackers to read arbitrary files.
Information disclosure and manipulation are also key impacts. CVE-2026-18904 (CVSSv3 8.2) could allow a remote attacker to obtain sensitive information and inject unauthorized messages due to a namespace collision issue related to user identifiers. Lastly, CVE-2026-18545 (CVSSv3 4.3) introduces a server-side request forgery (SSRF) vulnerability, allowing authenticated attackers to send unauthorized requests from the system, potentially aiding in network enumeration or other attacks.
All disclosed vulnerabilities affect IBM Langflow OSS versions from 1.0.0 through 1.11.1. Users are strongly advised to update to a patched version as soon as possible to mitigate these risks. The comprehensive nature of these vulnerabilities underscores the importance of rigorous security testing and timely patching for platforms handling sensitive user data and code execution.
The simultaneous disclosure of these eight vulnerabilities points to a significant security oversight in the development or configuration of Langflow OSS. Users relying on this platform for managing and executing AI workflows should prioritize updating their installations to prevent potential exploitation, which could range from unauthorized data access to complete system compromise. The breadth of issues, from command injection to SSRF, indicates a need for a thorough review of the platform's security posture.