CVE-2026-84889
HighCVSS 8.8Summary
IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to improper limitation of a pathname to a restricted directory.
Risk Assessment
An authenticated attacker can execute arbitrary code on the server, leading to full host compromise.
Recommendation
Upgrade IBM Langflow OSS to a version containing the fix and restrict network access to the application interface.
Other vulnerabilities in IBM Langflow OSS
See all- CVE-2026-81941High
IBM Langflow OSS 1.0.0 through 1.11.5 allows an authenticated non-administrative user to execute arbitrary OS commands on the server at the privilege level of the application process by constructing a flow with an MCP Tools component configured to use a local stdio subprocess transport. This bypasses both the LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY and LANGFLOW_BLOCK_CODE_INTERPRETER_COMPONENTS server-side controls intended to prevent exactly this class of access.
- CVE-2026-81940High
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special characters in flow display names. The flaw enables code injection through the flow name field.
- CVE-2026-81268High
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute flows and obtain sensitive information due to insufficient session expiration of API keys after user deactivation.
- CVE-2026-81265High
IBM Langflow OSS 1.0.0 through 1.11.5 — no vulnerability description was provided in the supplied source.
- CVE-2026-81213High
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to obtain sensitive information from internal network resources due to improper validation of user-supplied URLs.
- CVE-2026-81211High
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary Python code due to improper authorization of custom components in stored flows.
- CVE-2026-79742High
IBM Langflow OSS versions 1.0.0 through 1.11.5 contain an incomplete environment variable blocklist. A remote authenticated attacker could exploit this to execute arbitrary code.
- CVE-2026-79725Medium
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to read arbitrary files due to improper access control.
- CVE-2026-79723Medium
IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-controlled API endpoints.
- CVE-2026-78575High
IBM Langflow OSS versions 1.0.0 through 1.11.5 improperly validate command-line arguments in the MCP stdio server configuration. A remote authenticated attacker could execute arbitrary commands.
Original NVD description (English source)
IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to improper limitation of a pathname to a restricted directory.