Skip to content
OpenAdvisories
High WID-SEC-2026-1340 7 CVEs

IBM Langflow Desktop und OSS: Mehrere Schwachstellen

Published May 3, 2026 · Updated May 3, 2026 · de-DE

Vendor: IBM Product: Langflow Desktop Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM Langflow Desktop ausnutzen, um beliebigen Code auszuführen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder Cross-Site-Scripting-Angriffe durchzuführen.

Product

IBM LangChain Desktop ist eine lokale Anwendung zur Entwicklung und Ausführung von LangChain-basierten Anwendungen.

Vulnerabilities 7

  • High 8.8
    CVE-2026-6543

    Authenticated Remote Code Execution Vulnerability in Langflow Code Validation Endpoint

    IBM Langflow Desktop 1.0.0 through 1.8.4 Langflow allows an attacker to execute arbitrary commands with the privileges of the process running Langflow. This allows reading sensitive environment variables (API keys, DB credentials), modifying files, or launchi…

    IBM Langflow Desktop
  • High 7.5
    CVE-2026-4503

    Unauthenticated Insecure Direct Object Reference (IDOR) Vulnerability in Langflow Desktop Image Download Endpoint

    IBM Langflow Desktop 1.0.0 through 1.8.4 Langflow could allow an unauthenticated user to view other users' images due to an indirect object reference through a user-controlled key.

    IBM Langflow Desktop
  • Medium 6.5
    CVE-2026-3340

    Server-Side Request Forgery (SSRF) in Langflow URL Component

    IBM Langflow Desktop 1.0.0 through 1.8.4 IBM Langflow is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other…

    IBM Langflow Desktop
  • Medium 6.5
    CVE-2026-3345

    Path Traversal and Arbitrary File Write Vulnerability in IBM Langflow Desktop API v2 File Upload Endpoint

    IBM Langflow Desktop <=1.8.4 Langflow could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.

    IBM Langflow Desktop
  • Medium 6.5
    CVE-2026-4502

    Arbitrary File Write and Remote Code Execution Vulnerability in Langflow v2 API

    IBM Langflow Desktop 1.2.0 through 1.8.4 Langflow could allow an authenticated attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to write arbitrary files on the system.

    IBM Langflow Desktop
  • Medium 6.5
    CVE-2026-6542

    Monitor API allows cross-user read of transaction logs and deletion of build data via flow_id

    IBM Langflow OSS 1.0.0 through 1.8.4 could allow any user to supply a flow_id to read transaction logs and vertex build data belonging to other users, and to delete persisted vertex build data for another user's flow.

    IBM Langflow OSS
  • Medium 6.4
    CVE-2026-3346

    Stored Cross-Site Scripting (XSS) in Langflow Markdown Rendering via rehypeRaw

    IBM Langflow Desktop 1.6.0 through 1.8.4 Lanflow is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to cre…

    IBM Langflow Desktop

Revision history

  1. #1

    Initiale Fassung

References