Executive brief
IBM Langflow OSS, a tool used for building and deploying AI applications, contains a security flaw that allows users with valid API access to bypass safety controls. By sending specially crafted requests, an attacker can override application settings to execute their own malicious code on the server. This could lead to the theft of sensitive data, complete takeover of the server, or further attacks on the internal corporate network.
Technical details
A code injection vulnerability (CWE-94) exists in the API Graph Execution Engine of IBM Langflow OSS. The flaw is located within the parameter filtering logic of the `apply_tweaks()` function, which fails to properly sanitize component configurations provided via the API. An authenticated attacker can submit malicious 'tweak' parameters that, when processed by a Python Interpreter component, result in arbitrary code execution with the privileges of the application process. This allows for full system compromise, data exfiltration, and lateral movement. The issue is resolved in version 1.10.1.
Affected products
- IBM Langflow OSS 1.0.0 - 1.10.0
Timeline
- 2026-07-02: disclosed: Initial publication of the security bulletin by IBM
- 2026-07-17: advisory: NVD publication date