IBM Langflow OSS vulnerabilities

IBM Langflow OSS versions 1.0.0 through 1.11.1 allow an authenticated attacker to execute arbitrary operating system commands in the server process by saving a flow with a crafted type field value and triggering a build of a wrapper flow that references it. This allows privilege escalation from 'authenticated flow user' to arbitrary OS-level command execution, bypassing the LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false policy.

IBM Langflow OSS versions 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary code due to improper enforcement of security restrictions on the A2A public endpoint.

IBM Langflow OSS 1.0.0 through 1.9.6 could allow a remote attacker to obtain unauthorized access to user accounts due to improper restriction of excessive authentication attempts.

IBM Langflow OSS versions 1.0.0 through 1.10.0 could allow a remote attacker to inject arbitrary code on the system due to improper control of user input code.

IBM Langflow OSS versions 1.0.0 through 1.10.1 contain an improper input validation vulnerability in the PythonREPL sandbox implementation.

IBM Langflow OSS versions 1.0.0 through 1.10.1 are vulnerable to unauthenticated remote code execution via environment variable injection in the MCP stdio launcher. The vulnerability is due to an incomplete blocklist of dangerous environment variables (missing SHELLOPTS, BASHOPTS, and PS4) in src/lfx/src/lfx/base/mcp/util.py.

IBM Langflow OSS versions 1.0.0 through 1.10.1 contain hard-coded credentials (passwords or cryptographic keys) used for inbound authentication, outbound communication, or internal data encryption.

IBM Langflow OSS versions 1.0.0 through 1.10.0 allow authenticated users to escalate privileges to superuser by directly manipulating the database, execute arbitrary system commands, and achieve full system compromise with Langflow service permissions.

IBM Langflow OSS 1.0.0 through 1.10.0 has a vulnerability in webhook authentication logic that allows unauthenticated users to trigger execution of any flow when WEBHOOK_AUTH_ENABLE is set to False (default).

Critical vulnerability in IBM Langflow OSS versions 1.0.0 through 1.10.0 in the /api/v1/validate/code endpoint. Allows an authenticated attacker to execute arbitrary Python code on the server without sandboxing, leading to remote code execution.

IBM Langflow OSS versions 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in the disk-based caching mechanism. The AsyncDiskCache class uses Python's unsafe pickle.loads() function to deserialize cached objects without validation, integrity verification, or authentication.

IBM Langflow OSS versions 1.0.0 through 1.10.0 (up to commit 94981c443d4918517b9e8163d70fc598dc33a32d) contain a code injection vulnerability in the Policies component's ToolGuard integration that bypasses the allow_custom_components=false security control, allowing authenticated users with flow creation privileges to execute arbitrary Python code on the server.

Vulnerability in IBM Langflow OSS versions 1.0.0 through 1.10.0. The /api/v1/login/auto_login endpoint issues long-lived superuser bearer tokens without authentication when AUTO_LOGIN is enabled (default). Permissive CORS settings may expose tokens to untrusted origins.

IBM Langflow OSS versions 1.0.0 through 1.10.0 contain a vulnerability that could disclose all stored credentials. The issue is due to the use of a weak and reversible key derivation mechanism for encryption at rest.

IBM Langflow OSS versions 1.0.0 through 1.10.0 contain a vulnerability allowing authenticated attackers to execute arbitrary OS commands and read sensitive files including credentials. This leads to complete system compromise and enables lateral movement.

IBM Langflow OSS versions 1.0.0 through 1.10.0 contain a vulnerability allowing users with Redis access to execute arbitrary code with full application privileges. This compromises all secrets, data, and system integrity.

IBM Langflow OSS versions 1.0.0 through 1.10.0 contain a vulnerability allowing remote arbitrary code execution. The issue stems from improper validation of flow nodes with missing or empty component type fields.

IBM Langflow OSS versions 1.0.0 through 1.9.6 contain a vulnerability due to improper authorization enforcement in the Streamable MCP transport endpoint. This allows unauthenticated attackers to access protected MCP project resources and execute MCP operations.

IBM Langflow OSS versions 1.0.0 through 1.10.0 in voice mode have improper shared-state handling that allows reuse of API clients across tenant boundaries. An authenticated attacker can manipulate cache state to cause requests from other users to be processed using incorrect upstream API credentials, leading to cross-tenant billing and accountability misattribution.

IBM Langflow OSS versions 1.0.0 through 1.9.3 contain a critical vulnerability allowing an attacker to read all secrets available to the Langflow process, read and modify all flows, conversations, messages, file uploads, and saved components in the Langflow database. The attacker can also connect to internal services, abuse cloud metadata endpoints, laterally move to other tenants on the same Langflow instance, and establish persistence by modifying the public flow's `tool_code` so that normal `/api/v1/build/...` calls by any user re-execute attacker code at each build.

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote authenticated attacker to execute and read any user's private flow due to improper authorization.

IBM Langflow OSS versions 1.0.0 through 1.11.1 could allow a remote attacker to obtain sensitive information and inject unauthorized messages due to a namespace collision between user identifiers.

IBM Langflow OSS versions 1.0.0 through 1.11.1 could allow a remote attacker to read arbitrary files due to path traversal.

IBM Langflow OSS versions 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary flows and access sensitive information due to improper authentication.

IBM Langflow OSS versions 1.0.0 through 1.11.1 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code.

IBM Langflow OSS 1.0.0 through 1.11.1 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

IBM Langflow OSS versions 1.0.0 through 1.10.0 could allow a remote attacker to overwrite administrator email information and abuse the server as an outbound relay due to missing authentication for the registration endpoint.

IBM Langflow OSS versions 1.0.0 through 1.10.3 contain an authorization bypass vulnerability in the MemoryComponent that allows authenticated users to access chat history of other users via session_id collision. The retrieve_messages and store_message methods filter only on session_id without validating flow_id or user_id ownership, enabling cross-user information disclosure through multiple API endpoints.

IBM Langflow OSS versions 1.0.0 through 1.10.3 could allow a remote attacker to inject arbitrary code on the system due to improper control of user input code.

IBM Langflow OSS versions 1.0.0 through 1.10.3 use Python's non-cryptographic random module for generating Fernet encryption keys from user secrets under 32 characters. The deterministic Mersenne Twister PRNG produces identical keys for identical seeds, allowing attackers to reproduce encryption keys and decrypt stored API keys and authentication tokens.

IBM Langflow OSS versions 1.0.0 through 1.10.3 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing 'dot dot' sequences ( /../ ) to view arbitrary files on the system.

IBM Langflow OSS installations versions 1.0.0 through 1.10.3 allow anyone on the internet to execute arbitrary code on the server without any credentials via 2 HTTP requests.

IBM Langflow OSS 1.0.0 through 1.10.3 is vulnerable to Path Traversal in the Knowledge Bases API (POST /api/v1/knowledge_bases). This occurs because user-supplied knowledge base names are used directly to create file paths without proper sanitization or containment checks. An authenticated attacker can exploit this flaw to create directories and write files anywhere on the server's filesystem.

IBM Langflow OSS 1.0.0 through 1.10.3 does not properly validate the username field, allowing attackers to inject path traversal sequences and bypass containment checks. This enables multiple severe impacts, including arbitrary directory deletion, cross-tenant data destruction, and JWT signing key deletion leading to session invalidation.

IBM Langflow OSS versions 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to code injection.

IBM Langflow OSS versions 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of Python code during AST-based security scanning.

IBM Langflow OSS versions 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of module imports.

IBM Langflow OSS 1.0.0 through 1.10.3 does not properly validate ownership in the deprecated POST /api/v1/build/{flow_id}/vertices endpoint, allowing an authenticated user to inject arbitrary graph data into a shared cache for any flow. This may result in cross-user cache pollution, unauthorized workflow execution, or denial of service.

IBM Langflow OSS versions 1.0.0 through 1.10.3 contain a Server-Side Request Forgery (SSRF) vulnerability in the validate_model_provider_key() function for the Ollama provider. The function accepts a user-supplied OLLAMA_BASE_URL parameter and passes it directly to requests.get() without validation, scheme/host allowlisting, or filtering of private IP ranges.

IBM Langflow OSS 1.0.0 through 1.10.3 Langflow could allow server-side request forgery (SSRF) due to incomplete and ineffective SSRF protection enforcement.

IBM Langflow OSS versions 1.0.0 through 1.10.3 (repeated) could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

IBM Langflow OSS 1.0.0 through 1.10.3 allows remote authenticated attackers to bypass localhost-only restrictions and write arbitrary MCP server configurations to IDE configuration files on the host system.

IBM Langflow OSS 1.0.0 through 1.10.3 contain an authentication bypass vulnerability in the Model Context Protocol (MCP) composer endpoint when mcp_composer_enabled=true (default) and projects are configured with auth_type=oauth.

IBM Langflow OSS versions 1.0.0 through 1.10.1 allow an attacker to access another user's private vector documents by creating their own flow with matching Chroma persist_directory and collection_name values. The attacker receives exact victim content in their workflow output despite having no authorization to read the victim's flow. Additionally, the attacker can pollute the victim's collection by inserting their own documents into the shared namespace.

IBM Langflow OSS versions 1.0.0 through 1.10.1 allow a remote attacker to traverse directories on the system. An attacker can send a specially crafted URL request containing "dot dot" sequences ( /../ ) to view arbitrary files.

IBM Langflow OSS 1.0.0 through 1.10.1 allows authenticated users to access and manipulate other users' build jobs through improper access control on log retrieval and unauthenticated build endpoints.

IBM Langflow OSS versions 1.0.0 through 1.10.1 allow an attacker to reuse another user's FAISS namespace to access owner-only vector content and influence later query results. This causes cross-user information disclosure and limited integrity impact through persistent poisoning of returned results.

IBM Langflow OSS versions 1.0.0 through 1.10.1 allow an authenticated attacker to exploit the SaveToFile component to read and modify another user's uploaded files by specifying absolute paths to victim storage locations. In append mode, the attacker reads victim file contents, appends own data, and uploads a copy to their namespace. In overwrite mode, they can replace victim file contents with arbitrary data.

IBM Langflow OSS versions 1.0.0 through 1.10.0 allow authenticated users to override component parameters at runtime via the API. A critical security flaw exists in the parameter filtering mechanism within the `apply_tweaks()` function.