VYPR
Published Sep 4, 2026· Updated Sep 7, 2026· 1 source

IBM Langflow OSS: Seventeen Vulnerabilities Including Code Execution Disclosed Together

Key findings • Seventeen vulnerabilities disclosed in IBM Langflow OSS on Sept 4, 2026, spanning SSRF, path traversal, and auth bypass. • High severity flaws include arbitrary code execution …

Key findings

  • Seventeen vulnerabilities disclosed in IBM Langflow OSS on Sept 4, 2026, spanning SSRF, path traversal, and auth bypass.
  • High severity flaws include arbitrary code execution (CVE-2026-19298) and sensitive file access (CVE-2026-19306).
  • Multiple path traversal bugs allow access to arbitrary files and directories.
  • Server-side request forgery vulnerabilities (CVE-2026-19305, CVE-2026-17631) permit sensitive data disclosure.
  • Stored XSS in Playground chat interface identified as CVE-2026-8447.
  • Users must update IBM Langflow OSS to patched versions to mitigate risks.

On September 4, 2026, a batch of seventeen vulnerabilities was disclosed for IBM Langflow OSS, affecting versions 1.0.0 through 1.10.2 and 1.11.2. These vulnerabilities, disclosed within a two-hour window, span a range of security risks including server-side request forgery (SSRF), path traversal, improper authorization, and stored cross-site scripting (XSS), with several rated as High severity. The disclosures highlight significant security weaknesses that could allow authenticated attackers to access sensitive information, traverse directories, delete local files, or even execute arbitrary code.

Several vulnerabilities center on path traversal and directory manipulation. CVE-2026-17622, CVE-2026-14470, and CVE-2026-19299 allow authenticated attackers to traverse directories and view arbitrary files on the system by sending specially crafted URL requests with "dot dot" sequences. CVE-2026-19306, a High severity vulnerability, permits authenticated attackers to read sensitive server files, including secret material and other tenants' data, by supplying absolute paths or traversal sequences. Similarly, CVE-2026-17621 also enables directory traversal for viewing arbitrary files.

Server-side request forgery (SSRF) is another prominent theme. CVE-2026-17631 and CVE-2026-19301, both rated Medium, allow remote authenticated attackers to obtain sensitive information due to SSRF. CVE-2026-19305, a High severity vulnerability, also stems from SSRF, potentially leading to sensitive information disclosure. CVE-2026-19304, another High severity flaw, allows authenticated attackers to obtain sensitive information from internal services due to a URL parser discrepancy, which can be exploited through SSRF-like mechanisms.

Improper authorization and input validation contribute to further risks. CVE-2026-17627, a Medium severity vulnerability, involves improper authorization, enabling authenticated attackers to obtain sensitive information and inject messages into workflow history. CVE-2026-19298, a High severity vulnerability, allows authenticated attackers to execute arbitrary code due to an authorization bypass in the flow build process. CVE-2026-19302, rated High, involves incomplete scrubbing of sensitive credential fields, leading to sensitive information disclosure. CVE-2026-19303, a High severity flaw, permits authenticated attackers to delete arbitrary local files or directories due to improper limitation of a pathname to a restricted directory. CVE-2026-19302, rated High, involves incomplete scrubbing of sensitive credential fields, leading to sensitive information disclosure.

Additional vulnerabilities include CVE-2026-19300, a High severity issue where remote attackers can obtain sensitive information due to incomplete scrubbing of sensitive credential fields. CVE-2026-19302, rated Medium, involves improper validation of symbolic links, allowing authenticated attackers to obtain sensitive information. CVE-2026-9186, a Medium severity vulnerability, allows authenticated attackers to bypass localhost-only MCP configuration installation by spoofing the X-Forwarded-For header, enabling arbitrary writes to IDE config files. CVE-2026-9138, also Medium, permits authenticated attackers to write arbitrary files due to improper input validation in the SaveToFileComponent. Finally, CVE-2026-8447, a Medium severity stored XSS vulnerability, exists in the Playground chat interface.

The affected versions for these vulnerabilities are IBM Langflow OSS 1.0.0 through 1.10.2 for some CVEs and 1.0.0 through 1.11.2 for others. Users are strongly advised to update to the latest available versions to mitigate these risks. The clustered disclosure of these seventeen vulnerabilities underscores the importance of timely patching and security reviews for users of IBM Langflow OSS.

The breadth of these vulnerabilities, ranging from information disclosure and path traversal to arbitrary code execution and file deletion, presents a significant risk to organizations utilizing IBM Langflow OSS. The concentration of High severity issues, particularly those allowing code execution and sensitive data access, necessitates immediate attention from system administrators and security teams.

The disclosure of these seventeen vulnerabilities in IBM Langflow OSS on September 4, 2026, highlights critical security flaws across multiple functional areas. The vulnerabilities include SSRF, path traversal, improper authorization, and XSS, with several rated as High severity.

Key findings include:

Synthesized by Vypr AI