Do Son 
IBM X-Force has disclosed two security vulnerabilities in Langflow OSS, including a severe Langflow SSRF flaw. The flaws permit attackers to execute arbitrary code, steal cloud credentials, and bypass password restrictions. Administrators running self-hosted Langflow instances must apply the latest patches immediately to secure their AI development pipelines.
- Product: IBM Langflow OSS
- Vulnerabilities: 2 flaws (CVE-2026-12944, CVE-2026-17628)
- Highest severity: 9.6 (Critical · CVSSv3)
- Worst impact: Incomplete Security Scanner Blocklist Enables Network-Based Code Execution
- Status: No confirmed exploitation yet
- Action: See vendor advisories
| CVE | CVSS (CVSSv3) | Type | Status |
|---|---|---|---|
| CVE-2026-12944 | 9.6 | Incomplete Security Scanner Blocklist Enables Network-Based Code Execution | Not exploited |
| CVE-2026-17628 | 5.4 | Langflow is affected by improper authentication due to missing password verification in the password reset endpoint | Not exploited |
Track every CVE that hits your stack the moment it's exploited.
Get free email alertsWhy This Matters
Thousands of developers use Langflow OSS to build visual AI applications and deploy large language models. Therefore, these vulnerabilities expose critical developer environments and production AI workloads to severe risks. If attackers exploit the Langflow SSRF flaw, they can extract sensitive AWS IAM role permissions. Furthermore, intruders can pivot horizontally to compromise internal databases like PostgreSQL and Redis.
How the Attacks Work
The highest severity issue, CVE-2026-12944, stems from an incomplete security scanner blocklist. The scanner blocks dangerous Python modules like subprocess. However, it fails to block the socket and urllib standard libraries. The advisory explains, “This allowed authenticated users to submit components containing socket.connect() or urllib.request.urlopen() at module level, which executed server-side during component validation.”
Consequently, an attacker can submit malicious Python code that connects back to external servers. The system executes this code with root privileges inside the container. Attackers can use this flaw to establish reverse shells or exfiltrate local files.
The second vulnerability, CVE-2026-17628, involves improper authentication during password resets. The user management API accepts new passwords without verifying the current credential. This allows attackers who hijack a session to lock out legitimate users effortlessly. Currently, researchers have observed no active in-the-wild exploitation for either vulnerability.
Affected Versions
The Langflow SSRF flaw impacts all Langflow OSS versions from 1.0.0 through 1.10.0. The password reset vulnerability impacts versions 1.0.0 through 1.10.2.
Patch and Mitigation Steps
Administrators must update their environments without delay. IBM advises users to upgrade immediately to Langflow OSS version 1.10.3. This release resolves both the scanner blocklist failure and the password reset defect.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
