Executive brief
IBM Langflow OSS is a data integration and workflow automation platform. Versions 1.0.0 through 1.10.0 contain a critical vulnerability that allows authenticated users to execute arbitrary Python code with root privileges on the server. An attacker can exploit this to steal AWS credentials, exfiltrate sensitive files, or move laterally to internal databases like PostgreSQL and Redis within the container network.
Technical details
The vulnerability stems from an incomplete blocklist in the code security scanner used during component validation. While subprocess imports were correctly blocked, socket and urllib standard library modules were omitted, allowing server-side code execution. Authenticated attackers can submit custom components containing socket.connect() or urllib.request.urlopen() calls that execute during validation with root privileges (UID=0). The vulnerability is classified as SSRF (CWE-918) and enables credential theft via IMDSv1, arbitrary file exfiltration, and lateral movement within Docker networks. The scanner incorrectly returns "validated": true despite executing dangerous operations. Patches are available in version 1.10.1 and later.
Affected products
- IBM Langflow OSS 1.0.0 through 1.10.0
Timeline
- 2026-09-14: disclosed
- 2026-07-02: patched: Fix available in version 1.10.1