CVE-2026-5027

Langflow - Path Traversal Arbitrary File Write via upload_user_file

The 'POST /api/v2/files' endpoint does not sanitize the 'filename' parameter from the multipart form data, allowing an attacker to write files to arbitrary locations on the filesystem using path traversal sequences ('../').

CVSS 3.1 · 8.8 High EPSS 40.7% KEV · Not listed

Vendors

Langflow

Products

Langflow

CVE-2026-9196

Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling

IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute unintended code during Agentic Assistant validation due to improper handling of LLM‑generated components. The application executes model‑generated Python code in the backend during validation prior to user approval, which may allow an attacker to trigger side effects such as outbound network access, file system interaction, or data exfiltration with the privileges of the Langflow backend process.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Ibm Langflow

Products

Langflow Oss Langflow

CVE-2026-9205

Langflow is affected by weaknesses in secret handling and sensitive configuration access

IBM Langflow OSS contains a weak cryptographic key derivation vulnerability in the ensure_fernet_key() function.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Ibm Langflow

Products

Langflow Oss Langflow

CVE-2026-17630

Langflow is affected by security vulnerabilities in Model Context Protocol features

IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote attacker to execute arbitrary code due to improper validation of configuration parameters.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Ibm Langflow

Products

Langflow Oss Langflow

CVE-2026-9130

Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement

IBM Langflow OSS 1.0.0 through 1.10.3 contain an authorization bypass vulnerability in the MemoryComponent that allows authenticated users to access chat history of other users via session_id collision. The MemoryComponent.retrieve_messages and store_message methods filter on session_id without validating flow_id or user_id ownership, enabling cross-user information disclosure through multiple authenticated API endpoints including /api/v1/run/*, /api/v1/responses, and /api/v2/workflow/*. This vulnerability only affects multi-user deployments with LANGFLOW_AUTO_LOGIN=False.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Ibm Langflow

Products

Langflow Oss Langflow

CVE-2026-7869

Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement

IBM Langflow OSS 1.0.0 through 1.10.3 is vulnerable to Path Traversal in the Knowledge Bases API (`POST /api/v1/knowledge_bases`). This occurs because user-supplied knowledge base names are used directly to create file paths without proper sanitization or containment checks. An authenticated attacker can exploit this flaw to create directories and write files anywhere on the server's filesystem.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm Langflow

Products

Langflow Oss Langflow

CVE-2026-10128

Langflow is affected by weaknesses in secret handling and sensitive configuration access

IBM Langflow OSS 1.0.0 through 1.10.3 allows authenticated users can exploit a built-in Langflow component to read arbitrary server environment variables, exposing sensitive secrets despite security controls intended to disable custom components.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm Langflow

Products

Langflow Oss Langflow

CVE-2026-7658

Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement

IBM Langflow OSS 1.0.0 through 1.10.3 does not properly validate the username field, allowing attackers to inject path traversal sequences and bypass containment checks. This enables multiple severe impacts, including arbitrary directory deletion, cross-tenant data destruction, and JWT signing key deletion leading to session invalidation.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm Langflow

Products

Langflow Oss Langflow

CVE-2026-8182

Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling

IBM Langflow OSS 1.0.0 through 1.10.3 installations allow anyone on the internet to execute arbitrary code on the server without any credentials via 2 HTTP requests.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Ibm Langflow

Products

Langflow Oss Langflow

CVE-2026-17633

Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling

IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to code injection.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Ibm Langflow

Products

Langflow Oss Langflow

CVE-2026-17624

Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling

IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of module imports.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Ibm Langflow

Products

Langflow Oss Langflow

CVE-2026-9201

Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling

IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute arbitrary code due to a cryptographic weakness in the custom component validation mechanism. When the optional hardening mode that restricts execution to trusted component templates is enabled, the application validates component code using a truncated SHA‑256 hash. Because the hash comparison relies on only a portion of the digest, an attacker can craft malicious component code that collides with a trusted template hash and bypasses validation. Successful exploitation allows the attacker to introduce and execute unauthorized Python code within the Langflow process, defeating the intended security control and potentially leading to full compromise of the affected instance.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Ibm Langflow

Products

Langflow Oss Langflow

CVE-2026-17632

Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling

IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of Python code during AST-based security scanning.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Ibm Langflow

Products

Langflow Oss Langflow

CVE-2026-8470

Langflow is affected by weaknesses in secret handling and sensitive configuration access

IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 use Python's non-cryptographic random module for generating Fernet encryption keys from user secrets under 32 characters. The deterministic Mersenne Twister PRNG produces identical keys for identical seeds, allowing attackers to reproduce encryption keys and decrypt stored API keys and authentication tokens.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Ibm Langflow

Products

Langflow Oss Langflow

CVE-2026-10547

Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement

IBM Langflow OSS 1.0.0 through 1.10.3 does not properly validate ownership in the deprecated POST /api/v1/build/{flow_id}/vertices endpoint, allowing an authenticated user to inject arbitrary graph data into a shared cache for any flow. This may result in cross-user cache pollution, unauthorized workflow execution, or denial of service.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm Langflow

Products

Langflow Oss Langflow

CVE-2026-8478

Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling

IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote attacker to inject arbitrary code on the system, due to the improper control of user input code.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Ibm Langflow

Products

Langflow Oss Langflow

CVE-2026-8183

Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement

IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot " sequences ( /.. /) to v i ew arbitrary files on the system.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Ibm Langflow

Products

Langflow Oss Langflow

CVE-2026-9077

Reliance on Untrusted Inputs in a Security Decision vulnerabilities in Model Context Protocol features

IBM Langflow OSS 1.0.0 through 1.10.3 Langflow allows remote authenticated attackers to bypass localhost-only restrictions and write arbitrary MCP server configurations to IDE configuration files on the host system.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Ibm Langflow

Products

Langflow Oss Langflow

CVE-2026-17626

Langflow is affected by security vulnerabilities in Model Context Protocol features

IBM Langflow OSS 1.0.0 through 1.10.3 Langflow could allow an authenticated attacker to read, modify, or expose sensitive host files via Docker-based MCP servers due to incomplete filtering of dangerous Docker volume-mount and device-mapping arguments.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Ibm Langflow

Products

Langflow Oss Langflow

CVE-2026-17625

Langflow is affected by OS Command Injection in Model Context Protocol features

IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Ibm Langflow

Products

Langflow Oss Langflow