Vulnerabilities

IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 use Python's non-cryptographic random module for generating Fernet encryption keys from user secrets under 32 characters. The deterministic Mersenne Twister PRNG produces identical keys for identical seeds, allowing attackers to reproduce encryption keys and decrypt stored API keys and authentication tokens.

IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to inject arbitrary code on the system, due to the improper control of user input code.

IBM Langflow OSS 1.0.0 through 1.10.1 can allow an attacker to reuse another user's FAISS namespace to access owner-only vector content and influence later query results. This causes cross-user information disclosure and limited integrity impact through persistent poisoning of returned results.

IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in the disk-based caching mechanism. The AsyncDiskCache class uses Python's unsafe pickle.loads() function to deserialize cached objects from disk without validation, integrity verification, or authentication, enabling arbitrary code execution when malicious pickle payloads are processed. Attackers who can influence cached data through file system access, malicious workflow inputs, custom components, or API manipulation can achieve complete system compromise with the privileges of the Langflow server process.

IBM Langflow OSS 1.0.0 through 1.10.0 contains an unauthenticated code-injection flaw (CWE-94) that can be chained into full remote code execution. An attacker with network access first calls /api/v1/auto_login, which mints a SUPERUSER token to any caller without authentication, then calls /api/v1/validate/code, which executes attacker-supplied code via exec() on the Langflow host. Successful exploitation yields full control of the affected deployment, with high impact on confidentiality, integrity, and availability (CVSS 3.1: 9.8, network-exploitable with no privileges or user interaction required). Anyone running IBM Langflow OSS 1.0.0-1.10.0 is affected, especially default deployments reachable from untrusted networks. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-08-04, confirming active exploitation; EPSS estimates a 60.6% probability of exploitation within 30 days (99th percentile), and ransomware use is unknown.

Do: Upgrade IBM Langflow OSS to a release newer than 1.10.0 per IBM's ([email protected]) security advisory, as required under CISA's BOD 26-04 guidance for KEV entries; if mitigations are unavailable, discontinue use of the product per BOD 26-04. Until patched, restrict network access to the /api/v1/auto_login and /api/v1/validate/code endpoints (e.g., firewall rules or reverse-proxy controls) and avoid exposing the instance directly to the internet. Because exploitation is confirmed, review access logs for requests to these endpoints and signs of unauthenticated SUPERUSER token issuance or unexpected code execution.

IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated attackers to execute arbitrary OS commands and read sensitive files including credentials, enabling complete system compromise and lateral movement.