EUVD-2026-45308
GHSA-gqcf-9v26-p4pr
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Endpoint is public and unauthenticated (AV:N, PR:N, UI:N) with a trivial denylist bypass (AC:L); arbitrary code execution yields full host compromise (C:H/I:H/A:H).
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
6DescriptionNVD
IBM Langflow OSS 1.0.0 through 1.10.1 Lanflow OSS contains an unauthenticated remote code execution vulnerability in the public flow build endpoint ( /api/v1/build_public_tmp/{flow_id}/flow ). The vulnerability stems from an incomplete denylist in the validate_public_flow_no_code_execution() function that fails to block several code-execution agent components including OpenDsStarAgent, CodeActAgentSmolagents, and CSVAgent.
AnalysisAI
Unauthenticated remote code execution in IBM Langflow OSS versions 1.0.0 through 1.10.1 lets anonymous attackers run arbitrary code by abusing the public flow build endpoint (/api/v1/build_public_tmp/{flow_id}/flow). The CVSS 3.1 base score is 9.8 (network, low complexity, no privileges or user interaction). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target Langflow OSS instance (version 1.0.0-1.10.1) has the public flow build endpoint /api/v1/build_public_tmp/{flow_id}/flow reachable by the attacker, and that a public flow can be submitted or built containing one of the un-denylisted code-execution agent components (specifically OpenDsStarAgent, CodeActAgentSmolagents, or CSVAgent). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are largely consistent toward high priority but with one tension worth noting. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker discovers an internet-reachable Langflow OSS instance (≤1.10.1) with public flows enabled and submits a crafted flow to /api/v1/build_public_tmp/{flow_id}/flow that embeds a code-execution agent such as CodeActAgentSmolagents or CSVAgent. Because validate_public_flow_no_code_execution() does not block these components, the flow builds and executes the attacker's code on the server with no authentication or user interaction. … |
| Remediation | Upgrade to a fixed Langflow OSS release above 1.10.1 as directed by the IBM advisory at https://www.ibm.com/support/pages/node/7279997 - a patch is available per that vendor advisory, though the exact fixed version is not independently confirmed from the provided data, so verify the target version against the IBM page before deploying. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all IBM Langflow OSS instances in your environment and identify which are internet-facing or accessible without authentication. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Langflow before 1.3.0 allows unauthenticated remote code injection through the /api/v1/validate/code endpoint, enabling
Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote cod
Code injection in Langflow CSV Agent node before 1.8.0. The node hardcodes allow_dangerous_code=True, enabling arbitrary
Langflow has a third RCE vulnerability via exec_globals (EPSS 10.0%) allowing inclusion of untrusted code that executes
langflow <=1.0.18 is vulnerable to Remote Code Execution (RCE) as any component provided the code functionality and the
langflow v1.0.12 was discovered to contain a remote code execution (RCE) vulnerability via the PythonCodeTool component.
Langflow through 0.6.19 allows remote code execution if untrusted users are able to reach the "POST /api/v1/custom_compo
Langflow before 1.7.0.dev45 exposes multiple API endpoints without authentication, allowing unauthenticated access to us
Langflow versions prior to 1.0.13 suffer from a Privilege Escalation vulnerability, allowing a remote and low privileged
Langflow has a code injection vulnerability in the code component (EPSS 2.6%) enabling remote code execution through the
Langflow has an eval injection in eval_custom_component_code (EPSS 2.0%) enabling remote code execution through crafted
Remote code execution in IBM Langflow OSS 1.0.0 through 1.9.3 lets an unauthenticated attacker inject and run arbitrary
Share
External POC / Exploit Code
Leaving vuln.today