Executive brief
IBM Langflow OSS, a tool used to build AI applications, contains a critical security flaw that allows unauthenticated attackers to take full control of the server. An attacker can steal sensitive credentials, modify or delete AI workflows and user conversations, and gain access to other internal systems or cloud data. This could lead to a total compromise of the AI infrastructure and any data processed by the application.
Technical details
A code injection vulnerability (CWE-94) exists in IBM Langflow OSS due to the unsafe use of the Python `exec()` function within the `PythonCodeStructuredTool` component. When a flow is marked as 'PUBLIC', the `/api/v1/build_public_tmp/{flow_id}/flow` endpoint becomes accessible without authentication. An attacker can provide malicious Python code in the `tool_code` template field, which is executed on the server during the flow-build process. This allows for full remote code execution (RCE), enabling the attacker to read secrets, modify the database, access cloud metadata endpoints, and establish persistence by tampering with public flow components. The vulnerability is addressed in version 1.10.0.
Affected products
- IBM Langflow OSS 1.0.0 through 1.9.3
Timeline
- 2026-06-23: advisory: Initial publication by IBM
- 2026-06-30: disclosed: NVD publication date