High · 8.8 CVE-2026-14499 EUVD-2026-45306GHSA-q4fv-x4j4-jx84

Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints

Published Jul 17, 2026 · Updated Jul 23, 2026 · Assigned by ibm

Description

IBM Langflow OSS 1.0.0 through 1.10.1 Langflow could allow an authenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied input in the Python Interpreter component.

Affected products

Vendor	Product	Affected	Fixed
IBM	Langflow OSS	1.0.0 – ≤ 1.10.1	—

Advisories 2

WID-SEC-2026-2366 IBM Langflow Desktop: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 30, 2026
NCSC-2026-0251 Kwetsbaarheden verholpen in IBM Langflow OSS NCSC-NL (Netherlands) · Jul 21, 2026

References

https://www.ibm.com/support/pages/node/7279996 vendor-advisory patch

CNA	v3.1	8.8
EUVD	v3.1	8.8