Executive brief
IBM Langflow is an open-source platform for building AI workflows. A vulnerability in the authorization controls for custom components in stored flows allows an authenticated attacker to execute arbitrary Python code on the server. An attacker could compromise the server, steal sensitive data, modify files, or move laterally within the network.
Technical details
The vulnerability stems from improper authorization enforcement (CWE-862) of custom components in stored flows within Langflow OSS versions 1.0.0 through 1.11.5. The custom component admin-only policy is not enforced on the flow create and stored-flow build paths, only on the direct custom-component endpoint. An authenticated attacker can construct a flow containing attacker-controlled custom component source code and persist it, leading to arbitrary Python code execution with the privileges of the application process. Authentication is required to exploit this vulnerability; the attack vector is network-based.
Affected products
- IBM Langflow 1.0.0 through 1.11.5
Timeline
- 2026-09-10: disclosed