EUVD-2026-45308
GHSA-gqcf-9v26-p4pr
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Endpoint is public and unauthenticated (AV:N, PR:N, UI:N) with a trivial denylist bypass (AC:L); arbitrary code execution yields full host compromise (C:H/I:H/A:H).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
IBM Langflow OSS 1.0.0 through 1.10.1 Lanflow OSS contains an unauthenticated remote code execution vulnerability in the public flow build endpoint ( /api/v1/build_public_tmp/{flow_id}/flow ). The vulnerability stems from an incomplete denylist in the validate_public_flow_no_code_execution() function that fails to block several code-execution agent components including OpenDsStarAgent, CodeActAgentSmolagents, and CSVAgent.
AnalysisAI
Unauthenticated remote code execution in IBM Langflow OSS versions 1.0.0 through 1.10.1 lets anonymous attackers run arbitrary code by abusing the public flow build endpoint (/api/v1/build_public_tmp/{flow_id}/flow). The CVSS 3.1 base score is 9.8 (network, low complexity, no privileges or user interaction). No public exploit is identified at time of analysis, and the EPSS probability is modest at 0.44% (36th percentile), indicating exploitation is technically trivial but not yet observed at scale.
Technical ContextAI
Langflow is an open-source, Python-based visual builder for LLM and agentic workflows; flows are graphs of pluggable components, some of which (agent nodes) can execute code by design. The 'public flow' feature exposes a temporary build endpoint intended for untrusted callers, and it relies on validate_public_flow_no_code_execution() to reject any component capable of running code. The root cause is an incomplete denylist (CWE-184 / incomplete blacklist, feeding CWE-94 code injection): the allow-check enumerates dangerous components but omits several code-execution agent types - OpenDsStarAgent, CodeActAgentSmolagents, and CSVAgent - so a crafted public flow containing those nodes passes validation and executes attacker-controlled code. The affected package is identified by CPE cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*.
RemediationAI
Upgrade to a fixed Langflow OSS release above 1.10.1 as directed by the IBM advisory at https://www.ibm.com/support/pages/node/7279997 - a patch is available per that vendor advisory, though the exact fixed version is not independently confirmed from the provided data, so verify the target version against the IBM page before deploying. As compensating controls until patched: disable or do not expose the public flow feature so the /api/v1/build_public_tmp/{flow_id}/flow endpoint is unreachable by anonymous users (trade-off: breaks any legitimate public-flow sharing use case); place the Langflow instance behind authentication and network restrictions, blocking external access to the build_public_tmp path at a reverse proxy or WAF (trade-off: does not fix the underlying denylist gap, only reduces exposure); and avoid deploying Langflow directly on the untrusted internet. Do not rely on removing individual agent components, since the flaw is a validation-list gap and other unlisted code-execution components may exist.
Langflow before 1.3.0 allows unauthenticated remote code injection through the /api/v1/validate/code endpoint, enabling
Account takeover and remote code execution in Langflow AI workflow platform versions ≤1.6.9 due to a CORS misconfigurati
Langflow has a third RCE vulnerability via exec_globals (EPSS 10.0%) allowing inclusion of untrusted code that executes
Code injection in Langflow CSV Agent node before 1.8.0. The node hardcodes allow_dangerous_code=True, enabling arbitrary
Langflow has a code injection vulnerability in the code component (EPSS 2.6%) enabling remote code execution through the
Langflow through 0.6.19 allows remote code execution if untrusted users are able to reach the "POST /api/v1/custom_compo
langflow <=1.0.18 is vulnerable to Remote Code Execution (RCE) as any component provided the code functionality and the
langflow v1.0.12 was discovered to contain a remote code execution (RCE) vulnerability via the PythonCodeTool component.
Langflow before 1.7.0.dev45 exposes multiple API endpoints without authentication, allowing unauthenticated access to us
An unauthenticated shell injection vulnerability exists in Langflow's GitHub Actions CI/CD workflows, allowing attackers
Arbitrary file write vulnerability in an API endpoint (POST /api/v2/files) enables authenticated remote attackers to ove
Langflow versions prior to 1.0.13 suffer from a Privilege Escalation vulnerability, allowing a remote and low privileged
Same weakness CWE-184 – Incomplete List of Disallowed Inputs
View allShare
External POC / Exploit Code
Leaving vuln.today