CVE-2026-17633

IBM Langflow OSS versions 1.0.0 through 1.10.3 contain a code injection flaw (CWE-94) that lets a remote authenticated attacker execute arbitrary code on the host running the Langflow server. The issue is exploited through crafted input to an authenticated Langflow endpoint, where insufficient sanitization allows attacker-supplied code to be evaluated rather than treated as data. Successful exploitation gives the attacker code execution with the privileges of the Langflow process, typically resulting in full compromise of the server, access to configured API keys and credentials for LLM/data services, and potential lateral movement. Anyone self-hosting Langflow within the affected version range is exposed, though the requirement for valid credentials limits the attack surface compared to the unauthenticated Langflow flaws seen in 2025. A public proof-of-concept exists on GitHub, but EPSS is low (0.4%) and there is no evidence of in-the-wild exploitation or CISA KEV listing at this time.

What to do: Upgrade Langflow OSS to a release newer than 1.10.3 (the latest available version) as soon as possible. Until patched, do not expose the Langflow UI or API to untrusted networks, enforce strong authentication and least-privilege accounts for all users who can reach it, and run the service in an isolated container with minimal access to secrets and adjacent systems. Review logs for anomalous Python process execution or unexpected outbound traffic originating from the Langflow host, and rotate any LLM/API credentials stored in Langflow flows if compromise is suspected.