Skip to contentIbm Langflow Oss vulnerabilities
- ibm langflow oss, langflow +1 moreParameter Injection Vulnerability in API Graph Execution EngineCVE-2026-80568.8 High
- ibm langflow oss, langflow +1 moreDisk Cache Deserialization Remote Code Execution VulnerabilityCVE-2026-84769.9 Critical
- ibm langflow oss, langflow +1 moreRemote Code Execution via Code Validation EndpointCVE-2026-84819.9 Critical
- ibm langflow oss, langflow +1 moreAuthentication Bypass in Webhook Endpoints Allowed Unauthorized Flow ExecutionCVE-2026-8505Fix available9.8 Critical
- ibm langflow oss, langflow +1 moreArbitrary Code Execution in Python Interpreter ComponentCVE-2026-86359.9 Critical
- ibm langflow oss, langflow +1 morePath Traversal in APIRequest Component via Content-Disposition HeaderCVE-2026-88599.9 Critical
- ibm langflow oss, langflow +1 moreUnauthenticated Superuser Token Issuance via Auto-Login EndpointCVE-2026-91039.8 Critical
- ibm langflow oss, langflow +1 morePolicies Component Dynamic CodeInput Fields Bypass Custom Component ValidationCVE-2026-91359.9 Critical
- ibm langflow, langflow oss +1 moreUnauthenticated Remote Code Execution via Auto-Login Bypass and Code ValidationCVE-2026-9198In KEVPublic exploitEPSS 28.7%9.8 Critical
- ibm langflow oss, langflow +1 moreUnauthenticated User Registration Could Lead to Remote Code ExecutionCVE-2026-92029.8 Critical
- ibm langflow oss, langflow +1 moreSSRF via HTTP Redirect Following in Langflow API Request ComponentCVE-2026-101298.5 High
- ibm langflow oss, langflow +1 moreUnauthenticated Server-Side RCE via PythonCodeStructuredTool in Public FlowsCVE-2026-10134Public exploit10.0 Critical
- ibm langflow oss, langflow +1 moreCross-Tenant API Key Reuse and Billing Fraud in Langflow Voice Mode SubsystemCVE-2026-101409.6 Critical
- ibm langflow oss, langflow +1 moreDNS Rebinding TOCTOU Bypass of SSRF Protection in Langflow OSS URL ComponentCVE-2026-105467.1 High
- ibm langflow oss, langflow +1 moreUnauthenticated Access to Private Flow Build Events and Cancellation in Langflow OSSCVE-2026-105608.2 High
- ibm langflow oss, langflow +1 moreSSRF Vulnerability in Langflow OSS Legacy Components Bypasses ProtectionCVE-2026-105648.2 High
- ibm langflow oss, langflow +1 moreUnauthenticated Cross-User MCP Resource Access and Tool Execution via Streamable Transport Authorization BypassCVE-2026-76639.1 Critical
- ibm langflow oss, langflow +1 moreFlow Validation Bypass via Empty Component Type FieldCVE-2026-78039.8 Critical
- ibm langflow oss, langflow +1 moreInsecure Deserialization in Redis Cache BackendCVE-2026-78719.8 Critical
- ibm langflow oss, langflow +1 moreCode Injection Vulnerability in Code Validation EndpointCVE-2026-7873Public exploitFix available9.9 Critical
- ibm langflow oss, langflow +1 moreWeak Cryptographic Key Derivation Exposed All Stored CredentialsCVE-2026-78749.1 Critical
- ibm langflow oss, langflow +1 moreUnauthenticated Flow Execution via Webhook Endpoint in Langflow OSSCVE-2026-76649.8 Critical
- ibm langflow oss, langflow +1 moreUnauthenticated Remote Code Execution in Langflow OSS PythonREPLComponent via Builtins InjectionCVE-2026-10561Fix available10.0 Critical
- ibm langflow oss, langflow +1 moreUnauthenticated Session History Access via Public Flow ExecutionCVE-2026-77877.5 High
- ibm langflow oss, langflow +1 moreUnauthenticated File Upload Vulnerability Allows Disk Space Exhaustion and Path Disclosure in Langflow OSSCVE-2026-75287.1 High
- ibm langflow oss, langflow +1 morePath Traversal Vulnerability in File Processing Components Allows Unauthorized File System Access and Potential Remote Code ExecutionCVE-2026-75249.8 Critical
- ibm langflow oss, langflow +1 moreMonitor API allows cross-user read of transaction logs and deletion of build data via flow_idCVE-2026-65426.5 Medium