CVE-2026-13446

Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints

IBM Langflow OSS 1.0.0 through 1.10.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Apple Ibm Langflow and 2 more

Products

Macos Langflow Oss Langflow and 2 more

CVE-2026-7667

Path Traversal Vulnerability in API Request Component Content-Disposition Header Processing

IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated attacker to create a malicious flow pointing to an attacker-controlled URL that returns a specially crafted Content-Disposition header (e.g., filename="../../../target/path" ), enabling arbitrary file write operations with attacker-controlled content to any path accessible by the Langflow process.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Apple Ibm Langflow and 2 more

Products

Macos Langflow Oss Langflow and 2 more

CVE-2026-47304

.NET Security Feature Bypass Vulnerability

Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Apple Linux Microsoft

Products

Macos Linux Kernel .net and 19 more

CVE-2026-7754

SSRF Protection Configuration Vulnerability

IBM Langflow OSS 1.0.0 through 1.10.0 Langflow 1.9.0 could allow server-side request forgery (SSRF) due to insecure default configuration and incomplete enforcement of the SSRF protection mechanism.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Apple Ibm Langflow and 2 more

Products

Macos Langflow Oss Langflow and 2 more

CVE-2026-8635

Arbitrary Code Execution in Python Interpreter Component

IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated users to escalate privileges to superuser by directly manipulating the database, execute arbitrary system commands, and achieve full system compromise with Langflow service permissions.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Apple Ibm Langflow and 2 more

Products

Macos Langflow Oss Langflow and 2 more

CVE-2026-9135

Policies Component Dynamic CodeInput Fields Bypass Custom Component Validation

IBM Langflow OSS 1.0.0 through 1.10.0 Langflow versions up to 1.9.2 (commit 94981c443d4918517b9e8163d70fc598dc33a32d) contain a code injection vulnerability in the Policies component's ToolGuard integration that bypasses the allow_custom_components=false security control. The vulnerability exists because the validation mechanism only checks the main component source code in node_template["code"]["value"] but fails to validate dynamic CodeInput fields that store generated ToolGuard Python files. Attackers can embed malicious Python code in these unvalidated dynamic fields, which are persisted in Flow.data and later executed server-side when a guarded tool is invoked through the ToolGuard runtime. This allows authenticated users with flow creation privileges to achieve arbitrary Python code execution on the backend despite custom component restrictions. The vulnerability can be escalated through cross-tenant flow manipulation via the agentic MCP update_flow_component_field tool, which accepts attacker-controlled user_id parameters, enabling attackers to inject malicious code into victim users' flows. When combined with publicly accessible flows and specific misconfigurations (AUTO_LOGIN=true, NEW_USER_IS_ACTIVE=true), the attack can be conducted with reduced authentication requirements.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Apple Ibm Langflow and 2 more

Products

Macos Langflow Oss Langflow and 2 more

CVE-2026-8056

Parameter Injection Vulnerability in API Graph Execution Engine

IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated users to override component parameters at runtime via the API. A critical security flaw exists in the parameter filtering mechanism within the `apply_tweaks()` function.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Apple Ibm Langflow and 2 more

Products

Macos Langflow Oss Langflow and 2 more

CVE-2026-13445

Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints

IBM Langflow OSS 1.0.0 through 1.10.1 can allow an authenticated attacker to exploit the SaveToFile component to read and modify another user's uploaded files by specifying absolute paths pointing to victim storage locations. In append mode, the attacker's workflow reads victim file contents, appends attacker-controlled data, and uploads a copy containing victim data to the attacker's namespace (confidentiality breach). In overwrite mode, the attacker can replace victim file contents with arbitrary data (integrity breach). This breaks the storage ownership boundary between users.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Apple Ibm Langflow and 2 more

Products

Macos Langflow Oss Langflow and 2 more

CVE-2026-8476

Disk Cache Deserialization Remote Code Execution Vulnerability

IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in the disk-based caching mechanism. The AsyncDiskCache class uses Python's unsafe pickle.loads() function to deserialize cached objects from disk without validation, integrity verification, or authentication, enabling arbitrary code execution when malicious pickle payloads are processed. Attackers who can influence cached data through file system access, malicious workflow inputs, custom components, or API manipulation can achieve complete system compromise with the privileges of the Langflow server process.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Apple Ibm Langflow and 2 more

Products

Macos Langflow Oss Langflow and 2 more

CVE-2026-7872

Path Traversal Vulnerability in File Component Leading to Arbitrary File Read and Authentication Bypass

IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated attacker to read arbitrary files including the JWT signing key and forge authentication tokens for any user.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Apple Ibm Langflow and 2 more

Products

Macos Langflow Oss Langflow and 2 more

CVE-2026-14499

Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints

IBM Langflow OSS 1.0.0 through 1.10.1 Langflow could allow an authenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied input in the Python Interpreter component.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Apple Ibm Langflow and 2 more

Products

Macos Langflow Oss Langflow and 2 more

CVE-2026-9103

Unauthenticated Superuser Token Issuance via Auto-Login Endpoint

IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to gain unauthorized access due to improper authentication in the /api/v1/login/auto_login endpoint. The endpoint issues long-lived superuser bearer tokens without requiring authentication when the AUTO_LOGIN configuration is enabled (enabled by default), which may allow an unauthenticated network attacker to obtain full administrative access. Additionally, permissive cross-origin resource sharing (CORS) settings may allow tokens to be exposed to unintended origins, increasing the risk of unauthorized access.

CVSS 3.1 · 9.8 Critical EPSS 3.2% KEV · Not listed

Vendors

Apple Ibm Langflow and 2 more

Products

Macos Langflow Oss Langflow and 2 more

CVE-2026-8859

Path Traversal in APIRequest Component via Content-Disposition Header

IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow an attacker to write arbitrary files to unintended locations due to improper input validation in the APIRequest component. A path traversal vulnerability exists when the "Save to File" feature is enabled, where filenames extracted from HTTP response Content-Disposition headers are not sanitized before being joined to the temporary directory path. An attacker controlling an external HTTP server can supply crafted filename values containing path traversal sequences (e.g., ../), enabling arbitrary file writes to locations accessible by the Langflow process.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Apple Ibm Langflow and 2 more

Products

Macos Langflow Oss Langflow and 2 more

CVE-2026-30796

RustDesk Client Transmits Preset Address Book Password Verbatim in Heartbeat Sync

Cleartext Transmission of Sensitive Information, Insufficiently Protected Credentials vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Address book sync, Heartbeat sync loop modules) allows Sniffing Attacks. The client places the preset address-book password verbatim into the heartbeat sync JSON body (src/hbbs_http/sync.rs). Over an intact HTTPS session it is not exposed in transit, but it is a reusable shared secret rather than a zero-knowledge proof, so it is recovered by any party that becomes the API endpoint - under the re-homed/rogue API server (CVE-2026-30797) - and the leaked credential then authorizes the server-side address book. This vulnerability is associated with program files src/hbbs_http/sync.rs and program routines heartbeat sync body builder (emits preset-address-book-password). This issue affects RustDesk Client: through 1.4.8.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Apple Linux Microsoft and 3 more

Products

Macos Linux Kernel Windows and 3 more

CVE-2026-57108

.NET Denial of Service Vulnerability

Access of resource using incompatible type ('type confusion') in .NET Core allows an unauthorized attacker to deny service over a network.

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed

Vendors

Apple Linux Microsoft and 1 more

Products

Macos Linux Kernel .net and 2 more

CVE-2026-56170

ASP.NET Core Denial of Service Vulnerability

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed

Vendors

Apple Linux Microsoft and 1 more

Products

Macos Linux Kernel .net and 2 more

CVE-2026-8481

Remote Code Execution via Code Validation Endpoint

IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in the code validation API endpoint. The POST /api/v1/validate/code endpoint accepts user-supplied Python code and executes it directly using Python's built-in exec() function without sandboxing, input validation, or privilege restrictions, enabling any authenticated user to execute arbitrary system commands with the full privileges of the Langflow server process.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Apple Ibm Langflow and 2 more

Products

Macos Langflow Oss Langflow and 2 more

CVE-2026-47968

Audition | Out-of-bounds Write (CWE-787)

Audition is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Adobe Apple Microsoft

Products

Audition Macos Windows

CVE-2026-48309

Audition | Out-of-bounds Write (CWE-787)

Audition is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Adobe Apple Microsoft

Products

Audition Macos Windows

CVE-2026-47969

Audition | Out-of-bounds Read (CWE-125)

Audition is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Adobe Apple Microsoft

Products

Audition Macos Windows