Skip to content
OpenAdvisories
High WID-SEC-2026-2995 3 CVEs

Langflow OSS: Mehrere Schwachstellen

Published Aug 24, 2026 · Updated Aug 30, 2026 · Revision 3 · de-DE

Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Langflow OSS ausnutzen, um beliebigen Programmcode auszuführen, und um beliebigen Programmcode mit Administratorrechten auszuführen.

Product

Langflow bietet eine visuelle Schnittstelle zum Erstellen von LLM-basierten Anwendungen.

Vulnerabilities 3

  • Critical 9.9
    CVE-2026-19295 Public exploit

    Langflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcement

    IBM Langflow OSS 1.0.0 through 1.11.1 allows an authenticated attacker to execute arbitrary operating system commands in the server process by saving a flow with a crafted type field value and triggering a build of a wrapper flow that references it. This allo…

    IBM Langflow OSS
  • Critical 9.8
    CVE-2026-19286 Public exploit

    Langflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcement

    IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary code due to improper enforcement of security restrictions on the A2A public endpoint.

    IBM Langflow OSS
  • High 8.8
    CVE-2026-18729 Public exploit

    Langflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcement

    IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code.

    IBM Langflow OSS

Revision history

  1. #3

    Referenz(en) aufgenommen: EUVD-2026-67958, EUVD-2026-67956, EUVD-2026-67952

  2. #2

    PoC für CVE-2026-19295 aufgenommen

  3. #1

    Initiale Fassung

References