Executive brief
IBM Langflow OSS is an open-source framework for building AI applications with low-code workflows. A vulnerability in the flow-build endpoint allows authenticated non-administrator users to inject and execute arbitrary Python code, bypassing security controls designed to restrict code execution to administrators only. An attacker could steal secrets, environment variables, access files, and compromise the entire Langflow deployment.
Technical details
The vulnerability is a code injection flaw (CWE-94) in IBM Langflow OSS versions 1.0.0 through 1.11.2. The authenticated flow-build endpoint accepts inline graph data without properly validating the LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY setting or checking the attacker's superuser status before passing component code to the Python compiler. While the dedicated custom component API correctly enforces administrator-only restrictions, the flow-build endpoint bypasses this authorization check. An authenticated non-superuser attacker who owns a flow can inject arbitrary Python code that executes with the privileges of the Langflow service account. The vulnerability requires an existing valid user account and network access to the authenticated endpoint. IBM released version 1.11.3 as a fix.
Affected products
- IBM Langflow OSS 1.0.0 through 1.11.2
Timeline
- 2026-08-28: disclosed
- 2026-08-28: patched: Version 1.11.3 released as fix