Executive brief
IBM Langflow OSS is a platform for building AI applications by chaining language models and tools. A flaw in how the system validates configuration parameters allows authenticated attackers with high privileges to execute arbitrary code on the server, potentially compromising the entire application and any data it processes or stores.
Technical details
This vulnerability stems from incomplete validation (CWE-184) of configuration parameters in IBM Langflow OSS versions 1.0.0 through 1.10.3. An authenticated remote attacker with high-level privileges (PR:H) can supply specially crafted configuration values that bypass input filtering, leading to arbitrary code execution (ACE) in the Langflow server context. The attack requires network access and high-privilege authentication but no user interaction. IBM has released Langflow OSS 1.11.0 and newer versions with fixes; users should upgrade immediately.
Affected products
- IBM Langflow OSS 1.0.0 through 1.10.3
Timeline
- 2026-07-31: disclosed
- 2026-08-05: patched: Fix available in Langflow OSS 1.11.0 and newer