VYPR
Published Sep 10, 2026· Updated Sep 12, 2026· 1 source

IBM Langflow OSS: Batch of 18 Vulnerabilities Disclosed, Including Critical Code Execution Flaws

Key findings • 18 vulnerabilities disclosed for IBM Langflow OSS on September 10, 2026, affecting versions 1.0.0-1.11.5. • Two critical vulnerabilities (CVE-2026-81204, CVE-2026-79724, CVE-20…

Key findings

  • 18 vulnerabilities disclosed for IBM Langflow OSS on September 10, 2026, affecting versions 1.0.0-1.11.5.
  • Two critical vulnerabilities (CVE-2026-81204, CVE-2026-79724, CVE-2026-85025) with CVSSv3 9.8 allow arbitrary code/OS command execution.
  • Multiple high-severity flaws enable code execution via injection, authorization bypass, and unsafe eval() calls.
  • Several vulnerabilities permit authenticated attackers to access sensitive files and internal network resources.
  • One critical flaw (CVE-2026-85025) impacts unauthenticated users through public endpoints.
  • All affected versions range from 1.0.0 up to 1.11.5 (or 1.10.3 for CVE-2026-84889).

On September 10, 2026, a significant batch of 18 vulnerabilities was disclosed for IBM Langflow OSS, affecting versions 1.0.0 through 1.11.5. These vulnerabilities, disclosed within a one-hour window, range in severity from Medium to Critical, with two critical flaws (CVE-2026-81204, CVE-2026-79724, CVE-2026-85025) carrying a CVSSv3 score of 9.8. The disclosures highlight critical security weaknesses in how Langflow OSS handles code execution, data access, and user input validation.

Several vulnerabilities center on the ability for attackers to execute arbitrary code or commands. CVE-2026-81204 and CVE-2026-79724, both rated Critical, allow for arbitrary code execution and OS command execution, respectively, due to issues during graph construction and improper neutralization of special elements in OS commands. CVE-2026-85025, also Critical, permits unauthenticated attackers to execute arbitrary code and access/modify chat sessions through publicly shared endpoints due to inadequate security restrictions and session isolation.

Other high-severity vulnerabilities also enable arbitrary code execution through various means. CVE-2026-84889 involves improper pathname limitations, CVE-2026-81940 stems from improper neutralization of special characters in flow display names, and CVE-2026-81211 is due to improper authorization of custom components. Additionally, CVE-2026-79742 exploits an incomplete environment variable blocklist, CVE-2026-78575 arises from improper validation of command-line arguments, CVE-2026-78571 involves an unguarded eval() call, CVE-2026-78569 is due to an incomplete denylist in the security scanner, and CVE-2026-76059 bypasses the static security scanner through crafted annotated class-body assignments. CVE-2026-81941 allows authenticated non-administrative users to execute arbitrary OS commands by configuring MCP Tools components with a local stdio subprocess transport.

Beyond code execution, several vulnerabilities permit attackers to access sensitive information. CVE-2026-81268 allows authenticated users to obtain sensitive information due to insufficient session expiration of API keys after user deactivation. CVE-2026-81213 enables attackers to obtain sensitive information from internal network resources due to improper validation of user-supplied URLs. CVE-2026-79725, a medium-severity flaw, allows authenticated attackers to read arbitrary files due to improper access control. Similarly, CVE-2026-9225, also medium severity, allows authenticated attackers to access sensitive files belonging to other users via the File/Read File component. CVE-2026-79723, another medium-severity vulnerability, allows authenticated attackers to obtain sensitive information due to improper validation of user-controlled API endpoints. CVE-2026-81265 is also listed with high severity but lacks a specific description in the provided data.

All disclosed vulnerabilities affect IBM Langflow OSS versions from 1.0.0 up to 1.11.5 (or 1.10.3 for CVE-2026-84889). Users are strongly advised to update to patched versions as soon as possible to mitigate the risks associated with these critical and high-severity flaws. The tight disclosure window suggests a coordinated release of security findings, emphasizing the urgent need for users to review and apply available updates.

The sheer number and severity of these vulnerabilities underscore the importance of rigorous security practices when developing and deploying AI-powered tools like Langflow OSS. Users should prioritize updating their Langflow OSS installations to the latest secure versions and remain vigilant for any further security advisories from IBM.

Key findings from this batch include:

  • Two critical vulnerabilities (CVE-2026-81204, CVE-2026-79724, CVE-2026-85025) with CVSSv3 scores of 9.8 allow for arbitrary code and OS command execution.
  • Multiple high-severity flaws enable arbitrary code execution through various injection and authorization bypass techniques.
  • Several vulnerabilities allow authenticated attackers to access sensitive information, including arbitrary files and internal network resources.
  • All disclosed vulnerabilities affect IBM Langflow OSS versions 1.0.0 through 1.11.5.
  • The batch includes flaws related to improper input validation, authorization, session management, and path traversal.
  • One critical vulnerability (CVE-2026-85025) affects unauthenticated users via publicly shared endpoints.
Synthesized by Vypr AI