IBM Langflow OSS: Eight Vulnerabilities Including Critical Code Execution Flaws Disclosed Together
Key findings • Eight vulnerabilities disclosed simultaneously for IBM Langflow OSS, impacting versions 1.0.0 through 1.11.1. • Critical flaws include arbitrary code execution and OS command i…
Key findings
- Eight vulnerabilities disclosed simultaneously for IBM Langflow OSS, impacting versions 1.0.0 through 1.11.1.
- Critical flaws include arbitrary code execution and OS command injection, with CVSS scores up to 9.9.
- Vulnerabilities also permit unauthorized access to private flows, file reading, and sensitive information disclosure.
- Path traversal, SSRF, and namespace collision issues compound the security risks.
- All affected versions range from 1.0.0 to 1.11.1; users should update immediately.
On August 28, 2026, a batch of eight vulnerabilities was disclosed for IBM's Langflow OSS, with several critical and high-severity flaws impacting versions 1.0.0 through 1.11.1. These vulnerabilities collectively expose users to risks including arbitrary code execution, privilege escalation, and sensitive data exposure. The disclosures highlight significant security weaknesses within the platform's handling of user flows and endpoint security.
Several critical vulnerabilities allow for arbitrary code execution. CVE-2026-19286, with a CVSSv3 score of 9.8, stems from improper enforcement of security restrictions on the A2A public endpoint. Additionally, CVE-2026-19295 (CVSSv3 9.9) enables an authenticated attacker to execute arbitrary operating system commands by crafting a flow with a specific type field and triggering its build. Another critical flaw, CVE-2026-18729 (CVSSv3 8.8), allows authenticated attackers to execute arbitrary code due to improper control over code generation.
Further compromising security, CVE-2026-19294 (CVSSv3 6.4) permits a remote authenticated attacker to read any user's private flow due to insufficient authorization checks. CVE-2026-18891 (CVSSv3 8.2) allows remote attackers to execute arbitrary flows and access sensitive information, also attributed to improper authentication. Path traversal vulnerabilities are also present, with CVE-2026-18899 (CVSSv3 7.5) enabling remote attackers to read arbitrary files.
Information disclosure and manipulation are also key impacts. CVE-2026-18904 (CVSSv3 8.2) could allow a remote attacker to obtain sensitive information and inject unauthorized messages due to a namespace collision issue related to user identifiers. Lastly, CVE-2026-18545 (CVSSv3 4.3) introduces a server-side request forgery (SSRF) vulnerability, allowing authenticated attackers to send unauthorized requests from the system, potentially aiding in network enumeration or other attacks.
All disclosed vulnerabilities affect IBM Langflow OSS versions from 1.0.0 through 1.11.1. Users are strongly advised to update to a patched version as soon as possible to mitigate these risks. The comprehensive nature of these vulnerabilities underscores the importance of rigorous security testing and timely patching for platforms handling sensitive user data and code execution.
The simultaneous disclosure of these eight vulnerabilities points to a significant security oversight in the development or configuration of Langflow OSS. Users relying on this platform for managing and executing AI workflows should prioritize updating their installations to prevent potential exploitation, which could range from unauthorized data access to complete system compromise. The breadth of issues, from command injection to SSRF, indicates a need for a thorough review of the platform's security posture.
Threat actors have begun actively exploiting a critical remote code execution vulnerability in the AI low-code platform Langflow, tracked as CVE-2026-0768. This flaw, present in the custom component editor's code validator, allows unauthenticated attackers to execute arbitrary Python code with root privileges. Exploitation attempts, observed primarily from Russia, have focused on reconnaissance and credential harvesting, with over 360 attempts detected by VulnCheck on UK-based canaries.
Cybersecurity firm VulnCheck has observed a surge in active exploitation attempts targeting an earlier vulnerability in the Langflow AI agent-building tool, CVE-2026-0768. Attackers are actively probing for and attempting to exploit this critical flaw, which carries a CVSS score of 9.8, with reconnaissance and credential harvesting activities being noted. While the vulnerability was reportedly patched in version 1.10.1, the ongoing attacks indicate that outdated versions of Langflow remain widely deployed and targeted.
This new report indicates that the critical vulnerability CVE-2026-0768 in Langflow is not just disclosed but is actively being exploited by adversaries. The article highlights a growing trend of attacks specifically targeting the Langflow low-code AI development platform, suggesting an increasing threat landscape for such tools.