Skip to content
OpenAdvisories
High WID-SEC-2026-2965 5 CVEs

Langflow OSS: Mehrere Schwachstellen

Published Aug 23, 2026 · Updated Aug 30, 2026 · Revision 2 · de-DE

Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Langflow OSS ausnutzen, um Sicherheitsvorkehrungen zu umgehen, vertrauliche Informationen offenzulegen und Daten zu manipulieren.

Product

Langflow bietet eine visuelle Schnittstelle zum Erstellen von LLM-basierten Anwendungen.

Vulnerabilities 5

  • High 8.2
    CVE-2026-18891

    Langflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulnerabilities

    IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary flows and access sensitive information due to improper authentication.

    IBM Langflow OSS
  • High 8.2
    CVE-2026-18904

    Langflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulnerabilities

    IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to obtain sensitive information and inject unauthorized messages due to a namespace collision between user identifiers.

    IBM Langflow OSS
  • High 7.5
    CVE-2026-18899

    Langflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulnerabilities

    IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to read arbitrary files due to path traversal.

    IBM Langflow OSS
  • Medium 6.4
    CVE-2026-19294

    Langflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulnerabilities

    IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote authenticated attacker to execute and read any user's private flow due to improper authorization.

    IBM Langflow OSS
  • Medium 4.3
    CVE-2026-18545

    Langflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulnerabilities

    IBM Langflow OSS 1.0.0 through 1.11.1 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

    IBM Langflow OSS

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2026-67957, EUVD-2026-67955, EUVD-2026-67953, EUVD-2026-67951, EUVD-2026-67954

  2. #1

    Initiale Fassung

References