Advisories · Technology
IBM Langflow OSS.
Every CVE that names IBM Langflow OSS among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.5 Medium
Langflow OSS is affected by server-side request forgery due to missing URL validation in flow components
- IBM Langflow OSS
- Server-side request forgery (SSRF)
- CVSS 5.4 Medium
Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components
- IBM Langflow OSS
- Server-side request forgery (SSRF)
- CVSS 6.5 Medium
Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches
- IBM Langflow OSS
- Server-side request forgery (SSRF)
- CVSS 5.4 Medium
Langflow is affected by improper authentication due to missing password verification in the password reset endpoint
- IBM Langflow OSS
- Authentication bypass
- CVSS 8.8 High
Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards
- IBM Langflow OSS
- CWE-693
- CVSS 8.8 High
Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards
- IBM Langflow OSS
- Command injection
- CVSS 8.8 High
Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards
- IBM Langflow OSS
- Code injection
- CVSS 8.8 High
Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards
- IBM Langflow OSS
- Command injection
- CVSS 5.0 Medium
Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches
- IBM Langflow OSS
- Server-side request forgery (SSRF)
- CVSS 9.8 CriticalCritical · CVSS 9+
Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards
- IBM Langflow OSS
- Command injection
- CVSS 6.5 Medium
Langflow is vulnerable to unauthorized file system access due to path traversal and missing storage path validation
- IBM Langflow OSS
- Broken access control
- CVSS 8.8 High
Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards
- IBM Langflow OSS
- Code injection
- CVSS 9.8 CriticalCritical · CVSS 9+
Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards
- IBM Langflow OSS
- Code injection
- CVSS 8.8 High
Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards
- IBM Langflow OSS
- Broken access control
- CVSS 8.8 High
Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards
- IBM Langflow OSS
- Broken access control
- CVSS 8.6 High
Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches
- IBM Langflow OSS
- Server-side request forgery (SSRF)
- CVSS 7.5 High
Langflow is vulnerable to server-side request forgery due to missing egress validation on server-side URL fetches
- IBM Langflow OSS
- Server-side request forgery (SSRF)
- CVSS 8.1 High
Langflow is vulnerable to authentication bypass and insufficient session expiration
- IBM Langflow OSS
- Authentication bypass
- CVSS 8.8 High
Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards
- IBM Langflow OSS
- Code injection
- CVSS 8.8 High
A path traversal vulnerability in file handling components could allow an authenticated attacker to write files to arbitrary locations on the server filesystem
- IBM Langflow OSS
- Path traversal
- CVSS 9.8 CriticalCritical · CVSS 9+
Langflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards
- IBM Langflow OSS
- Broken access control
- CVSS 6.5 Medium
Langflow is vulnerable to unauthorized file system access due to path traversal and missing storage path validation
- IBM Langflow OSS
- Broken access control
- CVSS 6.5 Medium
Langflow OSS is affected by arbitrary file read due to path traversal vulnerabilities in file and knowledge base components
- IBM Langflow OSS
- Path traversal
- CVSS 4.9 Medium
Langflow is affected by improper authorization due to missing access control on the voice-mode WebSocket endpoint
- IBM Langflow OSS
- Broken access control
- CVSS 5.4 Medium
Langflow OSS is affected by arbitrary file read due to path traversal vulnerabilities in file and knowledge base components
- IBM Langflow OSS
- Path traversal
- CVSS 6.5 Medium
Langflow OSS is affected by arbitrary file read due to path traversal vulnerabilities in file and knowledge base components
- IBM Langflow OSS
- Path traversal
- CVSS 5.0 Medium
Langflow OSS is affected by server-side request forgery due to missing URL validation in flow components
- IBM Langflow OSS
- Server-side request forgery (SSRF)
- CVSS 8.8 High
Langflow is vulnerable to remote code execution due to authorization policy bypass in the authenticated flow-build endpoint
- IBM Langflow OSS
- Code injection
- CVSS 5.0 Medium
Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components
- IBM Langflow OSS
- Server-side request forgery (SSRF)
- CVSS 8.1 High
Langflow is vulnerable to arbitrary file write and arbitrary file deletion due to unvalidated paths in file-processing components
- IBM Langflow OSS
- Path traversal
- CVSS 7.5 High
Langflow is vulnerable to information disclosure due to cross-user MCP tool cache collision and incomplete secret scrubbing on public flows
- IBM Langflow OSS
- Information disclosure
- CVSS 6.5 Medium
Langflow is vulnerable to arbitrary local file read due to path traversal in ChatInput, bundle FileInput, and GitExtractor components
- IBM Langflow OSS
- Path traversal
- CVSS 6.5 Medium
Langflow is vulnerable to arbitrary local file read due to path traversal in ChatInput, bundle FileInput, and GitExtractor components
- IBM Langflow OSS
- Path traversal
- CVSS 7.7 High
Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components
- IBM Langflow OSS
- Server-side request forgery (SSRF)
- CVSS 8.6 High
Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components
- IBM Langflow OSS
- Server-side request forgery (SSRF)
- CVSS 7.7 High
Langflow is vulnerable to arbitrary local file read due to path traversal in ChatInput, bundle FileInput, and GitExtractor components
- IBM Langflow OSS
- Path traversal
- CVSS 6.5 Medium
Langflow is vulnerable to arbitrary file write and arbitrary file deletion due to unvalidated paths in file-processing components
- IBM Langflow OSS
- Path traversal
- CVSS 6.1 Medium
Langflow is vulnerable to stored cross-site scripting and IP spoofing due to unsanitized Markdown rendering and untrusted proxy header trust
- IBM Langflow OSS
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
Langflow is vulnerable to stored cross-site scripting and IP spoofing due to unsanitized Markdown rendering and untrusted proxy header trust
- IBM Langflow OSS
- Broken access control
- CVSS 9.9 CriticalCritical · CVSS 9+
Langflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcement
- IBM Langflow OSS
- Code injection
- CVSS 6.4 Medium
Langflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulnerabilities
- IBM Langflow OSS
- Broken access control
- CVSS 9.8 CriticalCritical · CVSS 9+
Langflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcement
- IBM Langflow OSS
- Code injection
- CVSS 8.2 High
Langflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulnerabilities
- IBM Langflow OSS
- Broken access control
- CVSS 7.5 High
Langflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulnerabilities
- IBM Langflow OSS
- Path traversal
- CVSS 8.2 High
Langflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulnerabilities
- IBM Langflow OSS
- Authentication bypass
- CVSS 8.8 High
Langflow is affected by multiple remote code execution vulnerabilities due to insufficient code-execution policy enforcement
- IBM Langflow OSS
- Code injection
- CVSS 4.3 Medium
Langflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulnerabilities
- IBM Langflow OSS
- Server-side request forgery (SSRF)
- CVSS 7.5 High
Unauthenticated Registration POST Endpoint Permits Admin Email Overwrite and Outbound Relay Abuse in Langflow
- IBM Langflow OSS
- Authentication bypass
- CVSS 9.1 CriticalCritical · CVSS 9+
Insufficient Authentication Brute Force Protection on Login Endpoint
- IBM Langflow OSS
- Authentication bypass
- CVSS 8.5 High
Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling
- IBM Langflow OSS
- Code injection
- CVSS 8.5 High
Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling
- IBM Langflow OSS
- Code injection
- CVSS 8.8 High
Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling
- IBM Langflow OSS
- Code injection
- CVSS 8.1 High
Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling
- IBM Langflow OSS
- Code injection
- CVSS 8.8 High
Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling
- IBM Langflow OSS
- Code injection
- CVSS 8.8 High
Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling
- IBM Langflow OSS
- Weak cryptography or TLS
- CVSS 8.8 High
Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling
- IBM Langflow OSS
- Code injection
- CVSS 7.7 High
Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement
- IBM Langflow OSS
- Path traversal
- CVSS 6.5 Medium
Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement
- IBM Langflow OSS
- Path traversal
- CVSS 7.1 High
Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement
- IBM Langflow OSS
- Broken access control
- CVSS 5.9 Medium
Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement
- IBM Langflow OSS
- Broken access control