Executive brief
IBM Langflow OSS is an open-source platform for building AI applications with visual workflows. A critical vulnerability allows unauthenticated attackers to execute arbitrary Python code on the server through the Agent-to-Agent (A2A) public endpoint when it is enabled, bypassing security restrictions that are normally enforced on other code execution paths. Successful exploitation gives attackers full control over the backend process, enabling data theft, service disruption, and lateral movement within the infrastructure.
Technical details
The vulnerability is a code injection flaw (CWE-94) in the A2A public execution endpoint that fails to invoke the validate_public_flow_no_code_execution guard applied to other unauthenticated execution surfaces. The root cause is improper enforcement of security restrictions: the A2A path does not validate or block code execution when auth_type=none agent flows are published, allowing an unauthenticated network caller to execute arbitrary Python in the Langflow backend process. The attack requires only network access (no authentication or user interaction needed) and is trivial to exploit (CVSS 9.8: AV:N/AC:L/PR:N/UI:N). The vulnerability affects Langflow OSS versions 1.0.0 through 1.11.1; IBM recommends immediate upgrade to version 1.11.2 or later.
Affected products
- IBM Langflow OSS 1.0.0 through 1.11.1
Timeline
- 2026-08-24: disclosed: Initial Publication
- 2026-08-28: patched: Version 1.11.2 addresses the vulnerability