Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

5 records

Advisory: IBM Langflow OSS — ibm.com/support/pages/node/7284579 Clear all filters
TI-2026-15738 CVE-2026-19294 · GHSA-m52h-5vqv-r8wf

Authorization bypass in IBM Langflow OSS

Priority LOW 29

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote authenticated attacker to execute and read any user's private flow due to improper authorization.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00329 Published 2026-08-28 No fix listed CWE-639
TI-2026-15461 CVE-2026-18904 · GHSA-rw3m-jm6r-xjcf

Authorization bypass in IBM Langflow OSS

Priority MEDIUM 42

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to obtain sensitive information and inject unauthorized messages due to a namespace collision between user identifiers.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00444 Published 2026-08-28 No fix listed CWE-639
TI-2026-15456 CVE-2026-18899 · GHSA-4w6q-3qxv-hmwg

Path traversal in IBM Langflow OSS

Priority MEDIUM 40

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to read arbitrary files due to path traversal.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00695 Published 2026-08-28 No fix listed CWE-22
TI-2026-15451 CVE-2026-18891 · GHSA-7rh9-6r38-qv3f

Improper authentication in IBM Langflow OSS

Priority MEDIUM 42

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary flows and access sensitive information due to improper authentication.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00537 Published 2026-08-28 No fix listed CWE-287
TI-2026-15208 CVE-2026-18545 · GHSA-2gc5-29jq-86vf

Server-side request forgery in IBM Langflow OSS

Priority LOW 20

IBM Langflow OSS 1.0.0 through 1.11.1 is vulnerable to server-side request forgery (SSRF).

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00298 Published 2026-08-28 No fix listed CWE-918