Skip to content
OpenAdvisories
High 1 exploited CVE NCSC-2026-0251 15 CVEs

Kwetsbaarheden verholpen in IBM Langflow OSS

Published Jul 21, 2026 · Updated Jul 21, 2026 · nl

Vendor: IBM Product: Langflow Product: Langflow Desktop Product: Langflow OSS

Summary

IBM heeft meerdere kwetsbaarheden verholpen in IBM Langflow OSS versies 1.0.0 tot en met 1.10.0.

Details

Interpretaties
De kwetsbaarheden in IBM Langflow OSS betreffen onder andere:
- het uitvoeren van willekeurige bestandswijzigingen door geauthenticeerde gebruikers via speciaal opgemaakte Content-Disposition headers
- server-side request forgery (SSRF) door onveilige standaardconfiguraties
- remote code execution (RCE) door onvoldoende validatie van MCP serverconfiguratiebestanden
- geauthenticeerde gebruikers kunnen bestanden lezen, waaronder de JWT signing key, wat het mogelijk maakt authenticatietokens te vervalsen
- een kwetsbaarheid in de apply_tweaks() functie die parameteroverriding via de API toestaat en unsafe deserialisatie in de AsyncDiskCache class die RCE mogelijk maakt
- het POST /api/v1/validate/code endpoint voert gebruikersgeleverde Python code uit zonder sandboxing, wat volledige servercontrole kan geven
- de webhook authenticatiemechanismen kunnen worden omzeild als de WEBHOOK_AUTH_ENABLE parameter op False staat, waardoor ongeauthenticeerde gebruikers flows kunnen uitvoeren
- ook is er een privilege escalation mogelijk tot superuser via het misbruiken van Langflow service permissies
- een path traversal kwetsbaarheid in de APIRequest component maakt het mogelijk om bestanden op ongewenste locaties te schrijven
- het /api/v1/login/auto_login endpoint kan bij ingeschakelde AUTO_LOGIN feature langelevensduur superuser tokens uitgeven zonder authenticatie, mede verergerd door permissieve CORS instellingen
- de Policies component bevat een code injection kwetsbaarheid in de ToolGuard integratie, waarbij geauthenticeerde gebruikers met flow creatie rechten arbitrary Python code kunnen uitvoeren
- ongeauthenticeerde aanvallers kunnen superuser tokens verkrijgen en daarmee volledige remote code execution uitvoeren op standaardinstallaties. Tevens kunnen zij een onbeperkt aantal actieve gebruikersaccounts aanmaken als de NEW_USER_IS_ACTIVE parameter op true staat, waarmee ze de AUTO_LOGIN restricties kunnen omzeilen en toegang krijgen tot remote code execution endpoints.

Oplossingen
IBM heeft updates uitgebracht om de kwetsbaarheden in IBM Langflow OSS te verhelpen. Zie bijgevoegde referenties voor meer informatie.

Vulnerabilities 15

  • Critical 9.8
    CVE-2026-9198 Exploited Public exploit Scanner template EPSS 29%

    Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation

    IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to any network caller) with /api/v1/validate/code (executes user code via exec()) to achieve full RCE on default Langflow deployments

    IBM Langflow OSS
    KEV Aug 4, 2026
  • Critical 9.9
    CVE-2026-8476

    Disk Cache Deserialization Remote Code Execution Vulnerability

    IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in the disk-based caching mechanism. The AsyncDiskCache class uses Python's unsafe pickle.loads() function to deserialize cached objects from disk without validation,…

    IBM Langflow OSS
  • Critical 9.9
    CVE-2026-8481

    Remote Code Execution via Code Validation Endpoint

    IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in the code validation API endpoint. The POST /api/v1/validate/code endpoint accepts user-supplied Python code and executes it directly using Python's built-in exec()…

    IBM Langflow OSS
  • Critical 9.9
    CVE-2026-8635

    Arbitrary Code Execution in Python Interpreter Component

    IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated users to escalate privileges to superuser by directly manipulating the database, execute arbitrary system commands, and achieve full system compromise with Langflow service permissions.

    IBM Langflow OSS
  • Critical 9.9
    CVE-2026-8859

    Path Traversal in APIRequest Component via Content-Disposition Header

    IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow an attacker to write arbitrary files to unintended locations due to improper input validation in the APIRequest component. A path traversal vulnerability exists when the "Save to File" feature is enab…

    IBM Langflow OSS
  • Critical 9.9
    CVE-2026-9135

    Policies Component Dynamic CodeInput Fields Bypass Custom Component Validation

    IBM Langflow OSS 1.0.0 through 1.10.0 Langflow versions up to 1.9.2 (commit 94981c443d4918517b9e8163d70fc598dc33a32d) contain a code injection vulnerability in the Policies component's ToolGuard integration that bypasses the allow_custom_components=false secu…

    IBM Langflow OSS
  • Critical 9.8
    CVE-2026-8505

    Authentication Bypass in Webhook Endpoints Allowed Unauthorized Flow Execution

    IBM Langflow OSS 1.0.0 through 1.10.0 has a vulnerability in Langflow's webhook authentication logic allows unauthenticated users to trigger the execution of any flow. The system incorrectly bypasses API key validation when the WEBHOOK_AUTH_ENABLE configurati…

    IBM Langflow OSS langflow PyPI
  • Critical 9.8
    CVE-2026-9103 Scanner template

    Unauthenticated Superuser Token Issuance via Auto-Login Endpoint

    IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to gain unauthorized access due to improper authentication in the /api/v1/login/auto_login endpoint. The endpoint issues long-lived superuser bearer tokens without requiring authentication wh…

    IBM Langflow OSS
  • Critical 9.8
    CVE-2026-9202

    Unauthenticated User Registration Could Lead to Remote Code Execution

    IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to create unlimited user accounts on any Langflow instance; when NEW_USER_IS_ACTIVE=true (documented deployment option), newly created accounts are immediately active and can authenticate …

    IBM Langflow OSS
  • High 8.8
    CVE-2026-14499

    Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints

    IBM Langflow OSS 1.0.0 through 1.10.1 Langflow could allow an authenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied input in the Python Interpreter component.

    IBM Langflow OSS
  • High 8.8
    CVE-2026-7667

    Path Traversal Vulnerability in API Request Component Content-Disposition Header Processing

    IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated attacker to create a malicious flow pointing to an attacker-controlled URL that returns a specially crafted Content-Disposition header (e.g., filename="../../../target/path" ), enabling arbitrary f…

    IBM Langflow OSS
  • High 8.8
    CVE-2026-7755

    MCP Server Configuration Validator Bypass via File Upload API

    IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow remote code execution due to incomplete validation enforcement on MCP server configuration files.

    IBM Langflow OSS
  • High 8.8
    CVE-2026-8056

    Parameter Injection Vulnerability in API Graph Execution Engine

    IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated users to override component parameters at runtime via the API. A critical security flaw exists in the parameter filtering mechanism within the `apply_tweaks()` function.

    IBM Langflow OSS
  • High 7.7
    CVE-2026-7754

    SSRF Protection Configuration Vulnerability

    IBM Langflow OSS 1.0.0 through 1.10.0 Langflow 1.9.0 could allow server-side request forgery (SSRF) due to insecure default configuration and incomplete enforcement of the SSRF protection mechanism.

    IBM Langflow OSS
  • High 7.5
    CVE-2026-7872

    Path Traversal Vulnerability in File Component Leading to Arbitrary File Read and Authentication Bypass

    IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated attacker to read arbitrary files including the JWT signing key and forge authentication tokens for any user.

    IBM Langflow OSS

Revision history

  1. #1.0.0

    Initiele versie

References

  • Reference
    https://www.ibm.com/support/pages/node/7278920
  • Reference
    https://www.ibm.com/support/pages/node/7278921
  • Reference
    https://www.ibm.com/support/pages/node/7278922
  • Reference
    https://www.ibm.com/support/pages/node/7278923
  • Reference
    https://www.ibm.com/support/pages/node/7278924
  • Reference
    https://www.ibm.com/support/pages/node/7278925
  • Reference
    https://www.ibm.com/support/pages/node/7278926
  • Reference
    https://www.ibm.com/support/pages/node/7278927
  • Reference
    https://www.ibm.com/support/pages/node/7278929
  • Reference
    https://www.ibm.com/support/pages/node/7278930
  • Reference
    https://www.ibm.com/support/pages/node/7278931
  • Reference
    https://www.ibm.com/support/pages/node/7278932
  • Reference
    https://www.ibm.com/support/pages/node/7278933
  • Reference
    https://www.ibm.com/support/pages/node/7278934
  • Reference
    https://www.ibm.com/support/pages/node/7279987
  • Reference
    https://www.ibm.com/support/pages/node/7279988
  • Reference
    https://www.ibm.com/support/pages/node/7279989
  • Reference
    https://www.ibm.com/support/pages/node/7279990
  • Reference
    https://www.ibm.com/support/pages/node/7279991
  • Reference
    https://www.ibm.com/support/pages/node/7279993
  • Reference
    https://www.ibm.com/support/pages/node/7279994
  • Reference
    https://www.ibm.com/support/pages/node/7279995
  • Reference
    https://www.ibm.com/support/pages/node/7279996
  • Reference
    https://www.ibm.com/support/pages/node/7279997