Summary
Ein Angreifer kann mehrere Schwachstellen in Langflow ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen, um Sicherheitsvorkehrungen zu umgehen.
Product
Langflow bietet eine visuelle Schnittstelle zum Erstellen von LLM-basierten Anwendungen.
Vulnerabilities 2
-
Critical 9.6
Incomplete Security Scanner Blocklist Enables Network-Based Code Execution
IBM Langflow OSS 1.0.0 through 1.10.0 can allow attackers to execute arbitrary Python code with root privileges (UID=0) on the Langflow server by submitting components containing socket or urllib imports. This enables: (1) AWS credential theft via IMDSv1 SSRF…
-
Medium 5.4
Langflow is affected by improper authentication due to missing password verification in the password reset endpoint
IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to change the password of an account due to improper authentication.
Revision history
-
#1
Initiale Fassung
References
-
IBM Security Bulletin vom 2026-09-14
https://www.ibm.com/support/pages/node/7278919
-
IBM Security Bulletin vom 2026-09-14
https://www.ibm.com/support/pages/node/7286684