Skip to content
OpenAdvisories
High WID-SEC-2026-3096 16 CVEs

Langflow OSS: Mehrere Schwachstellen

Published Aug 30, 2026 · Updated Sep 14, 2026 · Revision 3 · de-DE

Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Langflow OSS ausnutzen, um Sicherheitsmaßnahmen zu umgehen, beliebigen Code auszuführen, Server-Side Request Forgery (SSRF) durchzuführen, sensible Daten offenzulegen oder zu manipulieren oder Cross-Site-Scripting-Angriffe durchzuführen.

Product

Langflow bietet eine visuelle Schnittstelle zum Erstellen von LLM-basierten Anwendungen.

Vulnerabilities 16

  • High 8.8
    CVE-2026-19298

    Langflow is vulnerable to remote code execution due to authorization policy bypass in the authenticated flow-build endpoint

    IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to execute arbitrary code due to an authorization bypass in the flow build process.

    IBM Langflow OSS
  • High 8.6
    CVE-2026-19305

    Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components

    IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery.

    IBM Langflow OSS
  • High 8.1
    CVE-2026-19303

    Langflow is vulnerable to arbitrary file write and arbitrary file deletion due to unvalidated paths in file-processing components

    IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to delete arbitrary local files or directories due to improper limitation of a pathname to a restricted directory.

    IBM Langflow OSS
  • High 7.7
    CVE-2026-19304

    Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components

    IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information from internal services due to a URL parser discrepancy.

    IBM Langflow OSS
  • High 7.7
    CVE-2026-19306

    Langflow is vulnerable to arbitrary local file read due to path traversal in ChatInput, bundle FileInput, and GitExtractor components

    IBM Langflow OSS 1.0.0 through 1.11.2 allows an authenticated attacker to read arbitrary files from the server filesystem — including server secret material (secret_key, JWT signing keys, the application database, /proc/self/environ, and other tenants' upload…

    IBM Langflow OSS
  • High 7.5
    CVE-2026-19300

    Langflow is vulnerable to information disclosure due to cross-user MCP tool cache collision and incomplete secret scrubbing on public flows

    IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote attacker to obtain sensitive information due to incomplete scrubbing of sensitive credential fields.

    IBM Langflow OSS
  • Medium 6.5
    CVE-2026-12765

    Langflow OSS is affected by server-side request forgery due to missing URL validation in flow components

    IBM Langflow OSS 1.0.0 through 1.10.2 is vulnerable to server-side request forgery (SSRF). This may allow an unauthenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

    IBM Langflow OSS
  • Medium 6.5
    CVE-2026-19299

    Langflow is vulnerable to arbitrary local file read due to path traversal in ChatInput, bundle FileInput, and GitExtractor components

    IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to path traversal.

    IBM Langflow OSS
  • Medium 6.5
    CVE-2026-19302

    Langflow is vulnerable to arbitrary local file read due to path traversal in ChatInput, bundle FileInput, and GitExtractor components

    IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of symbolic links.

    IBM Langflow OSS
  • Medium 6.5
    CVE-2026-9138

    Langflow is vulnerable to arbitrary file write and arbitrary file deletion due to unvalidated paths in file-processing components

    IBM Langflow OSS 1.0.0 through 1.11.2 Langflow could allow an authenticated attacker to write arbitrary files to the server due to improper input validation in the SaveToFileComponent. The application constructs local file paths using attacker‑controlled inpu…

    IBM Langflow OSS
  • Medium 6.5
    CVE-2026-9186

    Langflow is vulnerable to stored cross-site scripting and IP spoofing due to unsanitized Markdown rendering and untrusted proxy header trust

    IBM Langflow OSS 1.0.0 through 1.11.2 allows remote authenticated attackers to bypass localhost-only MCP configuration installation by spoofing X-Forwarded-For: 127.0.0.1 header, enabling arbitrary writes to IDE config files (~/.cursor/mcp.json, etc.).

    IBM Langflow OSS
  • Medium 6.1
    CVE-2026-8447

    Langflow is vulnerable to stored cross-site scripting and IP spoofing due to unsanitized Markdown rendering and untrusted proxy header trust

    IBM Langflow OSS 1.0.0 through 1.11.2 suffer from a stored cross-site scripting vulnerability in the Playground chat interface.

    IBM Langflow OSS
  • Medium 5.4
    CVE-2026-12766

    Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components

    IBM Langflow OSS 1.0.0 through 1.11.2 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

    IBM Langflow OSS
  • Medium 5.0
    CVE-2026-17631

    Langflow OSS is affected by server-side request forgery due to missing URL validation in flow components

    IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery (SSRF) vulnerability.

    IBM Langflow OSS
  • Medium 5.0
    CVE-2026-19301

    Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components

    IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery.

    IBM Langflow OSS
  • Medium 4.2
    CVE-2026-12763

    Langflow is vulnerable to authentication bypass and insufficient session expiration

    IBM Langflow OSS 1.0.0 through 1.11.5 could allow an authenticated attacker to access another user's MCP server context due to improper cache key isolation in the MCP Tools component.

    IBM Langflow OSS

Revision history

  1. #3

    Referenz(en) aufgenommen: EUVD-2026-78086, EUVD-2026-78084, EUVD-2026-78087

  2. #2

    Referenz(en) aufgenommen: EUVD-2026-71217, EUVD-2026-71215, EUVD-2026-71271, EUVD-2026-71270, EUVD-2026-71262, EUVD-2026-71260, EUVD-2026-71216, EUVD-2026-71462, EUVD-2026-71598, EUVD-2026-71597, EUVD-2026-71596, EUVD-2026-71269, EUVD-2026-71266

  3. #1

    Initiale Fassung

References