CVE-2026-17632
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
IBM Langflow OSS versions 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of Python code during AST-based security scanning.
Risk Assessment
The risk is the possibility of remote arbitrary code execution by an authenticated user, which could lead to server compromise, data theft, or system integrity violation.
Recommendation
It is recommended to upgrade IBM Langflow OSS to the latest version and strengthen Python code validation in the AST scanning process to prevent malicious code injection.
Other vulnerabilities in IBM Langflow OSS
See all- CVE-2026-19295Critical
IBM Langflow OSS versions 1.0.0 through 1.11.1 allow an authenticated attacker to execute arbitrary operating system commands in the server process by saving a flow with a crafted type field value and triggering a build of a wrapper flow that references it. This allows privilege escalation from 'authenticated flow user' to arbitrary OS-level command execution, bypassing the LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false policy.
- CVE-2026-19286Critical
IBM Langflow OSS versions 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary code due to improper enforcement of security restrictions on the A2A public endpoint.
- CVE-2026-19297Critical
IBM Langflow OSS 1.0.0 through 1.9.6 could allow a remote attacker to obtain unauthorized access to user accounts due to improper restriction of excessive authentication attempts.
- CVE-2026-12946Critical
IBM Langflow OSS versions 1.0.0 through 1.10.0 could allow a remote attacker to inject arbitrary code on the system due to improper control of user input code.
- CVE-2026-13435Critical
IBM Langflow OSS versions 1.0.0 through 1.10.1 contain an improper input validation vulnerability in the PythonREPL sandbox implementation.
- CVE-2026-12940Critical
IBM Langflow OSS versions 1.0.0 through 1.10.1 are vulnerable to unauthenticated remote code execution via environment variable injection in the MCP stdio launcher. The vulnerability is due to an incomplete blocklist of dangerous environment variables (missing SHELLOPTS, BASHOPTS, and PS4) in src/lfx/src/lfx/base/mcp/util.py.
- CVE-2026-13446Critical
IBM Langflow OSS versions 1.0.0 through 1.10.1 contain hard-coded credentials (passwords or cryptographic keys) used for inbound authentication, outbound communication, or internal data encryption.
- CVE-2026-8635Critical
IBM Langflow OSS versions 1.0.0 through 1.10.0 allow authenticated users to escalate privileges to superuser by directly manipulating the database, execute arbitrary system commands, and achieve full system compromise with Langflow service permissions.
- CVE-2026-8505Critical
IBM Langflow OSS 1.0.0 through 1.10.0 has a vulnerability in webhook authentication logic that allows unauthenticated users to trigger execution of any flow when WEBHOOK_AUTH_ENABLE is set to False (default).
- CVE-2026-8481Critical
Critical vulnerability in IBM Langflow OSS versions 1.0.0 through 1.10.0 in the /api/v1/validate/code endpoint. Allows an authenticated attacker to execute arbitrary Python code on the server without sandboxing, leading to remote code execution.
Original NVD description (English source)
IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of Python code during AST-based security scanning.