Skip to contentIbm Langflow vulnerabilities
- ibm langflow oss, langflow +1 moreDisk Cache Deserialization Remote Code Execution VulnerabilityCVE-2026-84769.9 Critical
- ibm langflow oss, langflow +1 moreRemote Code Execution via Code Validation EndpointCVE-2026-84819.9 Critical
- ibm langflow oss, langflow +1 moreAuthentication Bypass in Webhook Endpoints Allowed Unauthorized Flow ExecutionCVE-2026-8505Fix available9.8 Critical
- ibm langflow oss, langflow +1 moreArbitrary Code Execution in Python Interpreter ComponentCVE-2026-86359.9 Critical
- ibm langflow oss, langflow +1 morePath Traversal in APIRequest Component via Content-Disposition HeaderCVE-2026-88599.9 Critical
- ibm langflow oss, langflow +1 moreUnauthenticated Superuser Token Issuance via Auto-Login EndpointCVE-2026-91039.8 Critical
- ibm langflow oss, langflow +1 morePolicies Component Dynamic CodeInput Fields Bypass Custom Component ValidationCVE-2026-91359.9 Critical
- ibm langflow, langflow oss +1 moreUnauthenticated Remote Code Execution via Auto-Login Bypass and Code ValidationCVE-2026-9198In KEVPublic exploitEPSS 28.7%9.8 Critical
- ibm langflow oss, langflow +1 moreUnauthenticated User Registration Could Lead to Remote Code ExecutionCVE-2026-92029.8 Critical
- ibm langflow oss, langflow +1 moreSSRF via HTTP Redirect Following in Langflow API Request ComponentCVE-2026-101298.5 High
- ibm langflow oss, langflow +1 moreUnauthenticated Server-Side RCE via PythonCodeStructuredTool in Public FlowsCVE-2026-10134Public exploit10.0 Critical
- ibm langflow oss, langflow +1 moreCross-Tenant API Key Reuse and Billing Fraud in Langflow Voice Mode SubsystemCVE-2026-101409.6 Critical
- ibm langflow oss, langflow +1 moreDNS Rebinding TOCTOU Bypass of SSRF Protection in Langflow OSS URL ComponentCVE-2026-105467.1 High
- ibm langflow oss, langflow +1 moreUnauthenticated Access to Private Flow Build Events and Cancellation in Langflow OSSCVE-2026-105608.2 High
- ibm langflow oss, langflow +1 moreSSRF Vulnerability in Langflow OSS Legacy Components Bypasses ProtectionCVE-2026-105648.2 High
- ibm langflow oss, langflow +1 moreUnauthenticated Cross-User MCP Resource Access and Tool Execution via Streamable Transport Authorization BypassCVE-2026-76639.1 Critical
- ibm langflow oss, langflow +1 moreFlow Validation Bypass via Empty Component Type FieldCVE-2026-78039.8 Critical
- ibm langflow oss, langflow +1 moreInsecure Deserialization in Redis Cache BackendCVE-2026-78719.8 Critical
- ibm langflow oss, langflow +1 moreCode Injection Vulnerability in Code Validation EndpointCVE-2026-7873Public exploitFix available9.9 Critical
- ibm langflow oss, langflow +1 moreWeak Cryptographic Key Derivation Exposed All Stored CredentialsCVE-2026-78749.1 Critical
- ibm langflow oss, langflow +1 moreUnauthenticated Flow Execution via Webhook Endpoint in Langflow OSSCVE-2026-76649.8 Critical
- ibm langflow oss, langflow +1 moreUnauthenticated Remote Code Execution in Langflow OSS PythonREPLComponent via Builtins InjectionCVE-2026-10561Fix available10.0 Critical
- ibm langflow desktop, langflow desktop +1 moreIBM Langflow Desktop 1.0.0 - 1.9.2 DNS Rebinding Bypasses SSRF Protection Allowing Access to Internal ServicesCVE-2026-33415.4 Medium
- ibm langflow oss, langflow +1 moreUnauthenticated Session History Access via Public Flow ExecutionCVE-2026-77877.5 High
- ibm langflow oss, langflow +1 moreUnauthenticated File Upload Vulnerability Allows Disk Space Exhaustion and Path Disclosure in Langflow OSSCVE-2026-75287.1 High
- ibm langflow oss, langflow +1 morePath Traversal Vulnerability in File Processing Components Allows Unauthorized File System Access and Potential Remote Code ExecutionCVE-2026-75249.8 Critical
- ibm langflow oss, langflow +1 moreMonitor API allows cross-user read of transaction logs and deletion of build data via flow_idCVE-2026-65426.5 Medium
- ibm langflow desktop, langflow desktop +1 moreAuthenticated Remote Code Execution Vulnerability in Langflow Code Validation EndpointCVE-2026-65438.8 High
- ibm langflow desktop, langflow desktop +1 morePath Traversal and Arbitrary File Write Vulnerability in IBM Langflow Desktop API v2 File Upload EndpointCVE-2026-33456.5 Medium
- ibm langflow desktop, langflow desktop +1 moreStored Cross-Site Scripting (XSS) in Langflow Markdown Rendering via rehypeRawCVE-2026-33466.4 Medium
- ibm langflow desktop, langflow desktop +1 moreServer-Side Request Forgery (SSRF) in Langflow URL ComponentCVE-2026-33406.5 Medium
- ibm langflow desktop, langflow desktop +1 moreArbitrary File Write and Remote Code Execution Vulnerability in Langflow v2 APICVE-2026-45026.5 Medium
- ibm langflow desktop, langflow desktop +1 moreUnauthenticated Insecure Direct Object Reference (IDOR) Vulnerability in Langflow Desktop Image Download EndpointCVE-2026-45037.5 High
- ibm langflow desktop, langflow +1 moreIBM Langflow Desktop FAISS Vector Store Remote Code Execution via malicious Pickle fileCVE-2026-33578.8 High