By vendor

Langflow vulnerabilities

Known CVEs affecting Langflow products, prioritized by severity, with SEC.co remediation and detection guidance.

12 published vulnerabilities

• CVE-2026-33760HIGH 8.8

  Langflow, a platform for building AI workflows and agents, contains a critical authorization flaw in its monitoring API. Any logged-in user can read, modify, or delete another user's data—including chat messages, workflow sessions, build artifacts, and LLM logs—simply by knowing or guessing the target user's resource identifiers. The vulnerability affects seven API endpoints that fail to verify ownership before granting access, a pattern known as broken object-level authorization (BOLA). While the codebase demonstrates that correct ownership checks are technically feasible (one endpoint implements them properly), the pattern was not consistently applied, leaving six others vulnerable. This flaw was introduced well before version 1.9.0 and is patched in that release.

• CVE-2026-10129HIGH 8.5

  IBM Langflow OSS versions 1.0.0 through 1.9.3 contain a Server-Side Request Forgery (SSRF) protection bypass flaw. Attackers with basic flow-author privileges can exploit the API Request component by enabling redirect following on a benign URL that chains to internal or localhost services. The application validates the first URL but ignores redirect destinations, allowing unauthorized access to internal systems, metadata endpoints, and private network resources. This can expose credentials, API tokens, and sensitive administrative data.

• CVE-2026-10560HIGH 8.2

  IBM Langflow OSS versions 1.0.0 through 1.9.6 have a flaw that allows anyone on the internet to access job build information and stop running jobs without needing a password or authentication token. An attacker only needs a valid job identifier to read sensitive build event data or cancel active jobs, leading to information leakage and service disruption.

• CVE-2026-10564HIGH 8.2

  IBM Langflow, an open-source low-code platform, contains a Server-Side Request Forgery (SSRF) vulnerability in versions 1.0.0 through 1.9.6. Two components—RSSReaderComponent and SearXNG—fail to validate URLs before making HTTP requests, allowing authenticated attackers to access internal systems. An attacker could reach cloud metadata services (such as AWS, Azure, or GCP IMDS endpoints) to steal IAM credentials, or probe internal networks. The issue is particularly concerning because agentic workflows can be manipulated via prompt injection to trigger these requests automatically.

• CVE-2026-55446HIGH 7.5

  Langflow versions prior to 1.0.19 contain a denial-of-service vulnerability in the file upload endpoint. An attacker can submit a specially crafted upload request with an extremely long multipart form boundary—without needing to authenticate—causing the application to become unresponsive and unusable for all legitimate users. The impact persists until the service is restarted or manually recovered.

• CVE-2026-7787HIGH 7.5

  IBM Langflow OSS versions 1.0.0 through 1.9.1 contain a flaw that allows authenticated users to access or alter sensitive data by exploiting insecure direct object references (IDOR). An attacker with valid credentials can bypass intended access controls to view or modify information they should not have permission to access. This represents a classic authorization weakness where the application relies on user-supplied identifiers without properly validating ownership or access rights.

• CVE-2026-10546HIGH 7.1

  IBM Langflow OSS versions 1.0.0 through 1.9.3 contain a Server-Side Request Forgery (SSRF) vulnerability in the URL component. An attacker with login credentials can exploit a timing weakness in how the system validates URLs to make the application fetch resources from unintended internal or external locations. The vulnerability leverages DNS rebinding, a technique where a domain name's IP address changes between the validation check and actual use, allowing bypass of security controls.

• CVE-2026-42867MEDIUM 6.5

  Langflow, a platform for building AI-powered agents and workflows, contains a path traversal vulnerability in its Knowledge Bases API that allows authenticated users to write files anywhere on the server. The flaw exists because user-provided knowledge base names are not properly validated before being used to construct file paths. An attacker with valid credentials can exploit this to create arbitrary directories and files, potentially compromising server integrity. The issue is resolved in version 1.9.0.

• CVE-2026-48520MEDIUM 6.1

  Langflow, a platform for building AI workflows and agents, has a file-read vulnerability in its "Shareable Playground" feature that allows public access to the flow. When a flow is made public, an attacker can craft execution requests that cause Langflow to read arbitrary files from the system—either local files or cloud storage like S3—and feed their contents into the LLM. This exposure depends on how the flow is configured and what storage backends are enabled. The vulnerability is patched in version 1.10.0.

• CVE-2026-55423MEDIUM 6.1

  Langflow, a platform for building AI workflows and agents, has a session management flaw in versions before 1.7.0. When a user clicks logout, their session token is not properly cleared from the system. This means the previous user remains authenticated until someone else logs in with different credentials. In shared or multi-user environments, this creates a window where an attacker with brief physical or remote access could maintain unauthorized access to the account and its data after the legitimate user believes they've logged out.

• CVE-2026-3341MEDIUM 5.4

  IBM Langflow Desktop versions 1.0.0 through 1.9.2 contain a server-side request forgery (SSRF) vulnerability that allows authenticated users to make unauthorized network requests from the affected system. An attacker with valid credentials could exploit this to map internal networks, access restricted services, or set up for secondary attacks. The vulnerability requires authentication, which reduces—but does not eliminate—the risk in environments where account compromise is possible.

• CVE-2026-12822MEDIUM 5.3

  A code injection vulnerability exists in Langflow (an AI/LLM orchestration framework) up to version 1.9.3, affecting the Bundle URL Loader component. An authenticated local user can manipulate input to the loader to inject and execute arbitrary code on the affected system. The vulnerability requires local access and valid user credentials, limiting its reach to internal threats or compromised accounts. Langflow's maintainers were notified but did not provide a response or patch timeline.