Langflow OSS: 24 Vulnerabilities Disclosed Together, Posing Severe Risks
A batch of 24 vulnerabilities, many rated High, were disclosed for Langflow OSS, exposing users to code execution, data theft, and more.
Key findings
- 24 vulnerabilities disclosed simultaneously for Langflow OSS, affecting versions 1.0.0 through 1.10.3.
- Multiple High-severity flaws enable arbitrary code execution, authentication bypass, and SSRF.
- Path traversal and file manipulation vulnerabilities allow access to sensitive system files and data.
- Weaknesses in cryptographic key derivation and component validation pose significant security risks.
- Users are urged to update immediately to patch these widespread security issues.
On August 5, 2026, a significant batch of 24 vulnerabilities was disclosed for Langflow OSS, a popular open-source project for orchestrating large language models. The vulnerabilities, disclosed within a two-hour window, span a wide range of severity, with many rated as High, and impact versions 1.0.0 through 1.10.3. These flaws collectively expose users to risks including arbitrary code execution, path traversal, authentication bypass, and sensitive data exposure.
Several vulnerabilities center on the improper handling of user input and component validation, enabling code injection and execution. CVE-2026-9196 and CVE-2026-17632 highlight issues with executing model-generated Python code and improper validation of Python code during AST-based security scanning, respectively. Similarly, CVE-2026-8478 and CVE-2026-17633 describe vulnerabilities allowing arbitrary code injection and execution due to improper control or validation of user input code and module imports. CVE-2026-17624 also falls into this category, related to improper validation of module imports.
Another significant theme is path traversal and directory manipulation. CVE-2026-8183 and CVE-2026-7869 detail path traversal vulnerabilities that could allow attackers to access or manipulate files outside of intended directories. CVE-2026-7658 and CVE-2026-10128 further exacerbate these risks by allowing arbitrary directory deletion, cross-tenant data destruction, and JWT signing key deletion, or by enabling the reading of arbitrary server environment variables. CVE-2026-7646 also allows reading arbitrary files from the server filesystem, including sensitive data like JWT signing secrets and SQLite databases, through crafted MCP requests. CVE-2026-17626 specifically mentions the risk of reading, modifying, or exposing sensitive host files via Docker-based MCP servers due to incomplete filtering of dangerous Docker arguments.
Authentication bypass and authorization flaws are also prevalent. CVE-2026-9130 describes an authorization bypass in the MemoryComponent, allowing authenticated users to access chat histories of others. CVE-2026-8470 and CVE-2026-9205 point to weaknesses in cryptographic key derivation, using Python's non-cryptographic random module for generating encryption keys, which could lead to predictable keys. CVE-2026-8470 specifically mentions the deterministic Mersenne Twister PRNG producing identical keys for identical seeds. CVE-2026-8446 details an authentication bypass in the Model Context Protocol (MCP) composer endpoint under specific configurations. Furthermore, CVE-2026-9077 allows bypassing localhost-only restrictions to write arbitrary MCP server configurations to IDE configuration files.
Server-Side Request Forgery (SSRF) is another critical vulnerability class present in this batch. CVE-2026-9081 and CVE-2026-7657 describe SSRF vulnerabilities where user-supplied URLs or parameters are not properly validated, potentially allowing attackers to make requests to internal or external resources on behalf of the server.
Finally, several high-severity vulnerabilities allow for arbitrary code execution without strong authentication or through complex attack vectors. CVE-2026-9201 mentions a cryptographic weakness in custom component validation that could lead to arbitrary code execution, even when hardening mode is enabled. CVE-2026-8182 stands out, stating that installations allow anyone on the internet to execute arbitrary code on the server without credentials via just two HTTP requests. CVE-2026-17625 and CVE-2026-17630 also detail arbitrary code execution due to improper neutralization of special elements in OS commands or improper validation of configuration parameters, respectively. CVE-2026-17623 allows arbitrary command execution due to improper validation of the command field in MCP server configurations.
All disclosed vulnerabilities affect Langflow OSS versions 1.0.0 through 1.10.3. Users are strongly advised to update to a patched version as soon as possible to mitigate these widespread security risks. The sheer number and severity of these vulnerabilities underscore the importance of prompt patching and security reviews for Langflow OSS deployments.
The disclosed vulnerabilities include: CVE-2026-9205, CVE-2026-9201, CVE-2026-9196, CVE-2026-9130, CVE-2026-8478, CVE-2026-8470, CVE-2026-8183, CVE-2026-8182, CVE-2026-7869, CVE-2026-7658, CVE-2026-17633, CVE-2026-17632, CVE-2026-17624, CVE-2026-10547, CVE-2026-9081, CVE-2026-7657, CVE-2026-17625, CVE-2026-10128, CVE-2026-9077, CVE-2026-8446, CVE-2026-7646, CVE-2026-17630, CVE-2026-17626, CVE-2026-17623.