Executive brief
IBM Langflow OSS, a visual tool for building AI workflows, contains a security flaw that allows unauthorized users to execute arbitrary code on the server. By sending a specially crafted request to a public endpoint, an attacker could take control of the service, potentially leading to data theft or a complete system compromise. This vulnerability affects organizations using Langflow to manage AI agents and workflows.
Technical details
IBM Langflow OSS versions 1.0.0 through 1.10.1 are vulnerable to unauthenticated remote code execution (RCE) via the '/api/v1/build_public_tmp/{flow_id}/flow' endpoint. The root cause is an incomplete denylist in the 'validate_public_flow_no_code_execution()' function, which fails to restrict several agent components capable of code execution, specifically OpenDsStarAgent, CodeActAgentSmolagents, and CSVAgent. An attacker can exploit this by submitting a flow containing these components to the public build endpoint. Successful exploitation allows for arbitrary code execution with the privileges of the service process. The vulnerability is addressed in version 1.10.2.
Affected products
- IBM Langflow OSS 1.0.0 through 1.10.1
Timeline
- 2026-07-14: advisory: Initial publication by IBM
- 2026-07-17: disclosed: NVD publication date
- 2026-07-14: patched: IBM recommends upgrading to version 1.10.2