CVE-2026-81211

IBM Langflow OSS versions 1.0.0 through 1.11.5 contain an improper authorization flaw (CWE-862) affecting custom components used in stored flows, meaning the application fails to adequately verify permissions when these components run. A remote attacker who holds valid low-privileged credentials can trigger execution of a stored flow's custom components over the network and have arbitrary Python code executed on the server. Successful exploitation grants code execution with the application's privileges, with high impact to confidentiality, integrity, and availability, and can lead to full server compromise given Langflow's flexible component model. Any deployment of Langflow OSS in the affected version range is exposed, with risk concentrated in shared or multi-tenant instances where untrusted or low-privilege users can run flows. The vulnerability is not listed in CISA's KEV catalog and no public proof-of-concept or known in-the-wild exploitation has been reported.

What to do: Upgrade Langflow OSS to a fixed release beyond 1.11.5 as soon as IBM publishes a patched version, and check the IBM PSIRT advisory for the recommended version. Until patched, restrict flow execution and flow-editing permissions to trusted users only, avoid exposing Langflow directly to the internet, and review logs for unexpected Python execution or unusual flow runs by low-privilege accounts.