Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

11 records

Advisory: IBM Langflow OSS — ibm.com/support/pages/node/7286666 Clear all filters
TI-2026-53245 CVE-2026-76059 · GHSA-xffc-qfh4-r9p6

Protection mechanism failure in IBM Langflow OSS

Priority MEDIUM 41

IBM Langflow OSS 1.0.0 through 1.11.5 An attacker who could submit custom component source code could bypass the static security scanner by crafting an annotated class-body assignment that resolved to a dangerous callabl…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00733 Published 2026-09-10 No fix listed CWE-693
TI-2026-54624 CVE-2026-78569 · GHSA-q4m2-w5fx-64v5

OS command injection in IBM Langflow OSS

Priority MEDIUM 41

IBM Langflow OSS 1.0.0 through 1.11.5 could allow an authenticated attacker to execute arbitrary code due to an incomplete denylist in the security scanner.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00708 Published 2026-09-10 No fix listed CWE-78
TI-2026-54625 CVE-2026-78571 · GHSA-qfhm-pm4r-cjpm

Code injection in IBM Langflow OSS

Priority MEDIUM 42

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to an unguarded eval() call on attacker-controlled input.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00807 Published 2026-09-10 No fix listed CWE-94
TI-2026-54628 CVE-2026-78575 · GHSA-gcjr-xxm4-x2j5

OS command injection in IBM Langflow OSS

Priority MEDIUM 41

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary commands due to improper validation of command-line arguments in the MCP stdio server configuration.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00794 Published 2026-09-10 No fix listed CWE-78
TI-2026-55209 CVE-2026-79724 · GHSA-x3hp-6r77-cxgw

OS command injection in IBM Langflow OSS

Priority MEDIUM 50

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to execute arbitrary OS commands due to improper neutralization of special elements used in an OS command.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00673 Published 2026-09-10 No fix listed CWE-78
TI-2026-55223 CVE-2026-79742 · GHSA-g64v-m7wp-6r42

Code injection in IBM Langflow OSS

Priority MEDIUM 42

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to an incomplete environment variable blocklist.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00875 Published 2026-09-10 No fix listed CWE-94
TI-2026-56092 CVE-2026-81204 · GHSA-82x2-gm4f-9fwx

Code injection in IBM Langflow OSS

Priority MEDIUM 50

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to execute arbitrary code due to code injection during graph construction.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0086 Published 2026-09-10 No fix listed CWE-94
TI-2026-56097 CVE-2026-81211 · GHSA-m6qv-7wcf-v4qx

Missing authorization in IBM Langflow OSS

Priority MEDIUM 41

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary Python code due to improper authorization of custom components in stored flows.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00559 Published 2026-09-10 No fix listed CWE-862
TI-2026-56547 CVE-2026-81941 · GHSA-m5q4-pf3r-r78g

Improper access control in IBM Langflow OSS

Priority MEDIUM 41

IBM Langflow OSS 1.0.0 through 1.11.5 allows an authenticated non-administrative user could execute arbitrary operating system commands on the server at the privilege level of the application process by constructing a fl…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00626 Published 2026-09-10 No fix listed CWE-284
TI-2026-56546 CVE-2026-81940 · GHSA-c28j-rh28-j7f7

Code injection in IBM Langflow OSS

Priority MEDIUM 42

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special characters in flow display names.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00807 Published 2026-09-10 No fix listed CWE-94
TI-2026-58414 CVE-2026-85025 · GHSA-j9vg-5378-pr5p

Incorrect authorization in IBM Langflow OSS

Priority MEDIUM 50

IBM Langflow OSS 1.0.0 through 1.11.5 Langflow could allow an unauthenticated attacker to execute arbitrary code and access or modify chat sessions through publicly shared MCP project endpoints due to improper enforcemen…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00614 Published 2026-09-10 No fix listed CWE-863