CVE-2026-12944

IBM Langflow OSS versions 1.0.0 through 1.10.0 allow a low-privileged attacker to submit workflow components containing socket or urllib imports, which the server executes as arbitrary Python code with root privileges (UID=0) inside the Langflow container. The built-in validation scanner incorrectly returns 'validated': true for these malicious components, giving operators a false sense that submitted flows are safe. Successful exploitation enables AWS credential theft via IMDSv1 SSRF using the instance's full IAM role permissions, arbitrary file exfiltration from the container filesystem, and lateral movement to internal services such as PostgreSQL and Redis on the Docker network. Anyone running a self-hosted Langflow server in the affected range that permits untrusted or semi-trusted users to build and submit flows is affected. The flaw is rated critical (CVSS 9.6), but no public proof-of-concept, known in-the-wild exploitation, or CISA KEV listing exists at this time.

What to do: Upgrade IBM Langflow OSS to a version newer than 1.10.0 as soon as IBM releases a fix, and check the IBM PSIRT advisory for the patched build. Do not rely on the component validator's 'validated': true signal — treat all user-submitted components as untrusted and restrict who can create or import flows. Harden the environment by running the container as a non-root user, enforcing IMDSv2 (disable IMDSv1) on cloud hosts, segmenting the Docker network from databases like PostgreSQL/Redis, and rotating AWS credentials and other secrets if untrusted flows were ever executed.