Langflow Oss
Monthly
Unauthenticated remote code execution in IBM Langflow OSS versions 1.0.0 through 1.9.3 allows attackers to fully compromise the host by bypassing authentication and abusing improper Python execution isolation. The maximum CVSS 10.0 score (AV:N/AC:L/PR:N/UI:N with scope change) reflects trivial network-based exploitation against any internet-exposed instance, though no public exploit identified at time of analysis. IBM has confirmed the issue and released a patch via support advisory node/7277242.
Insecure direct object reference (IDOR) in IBM Langflow OSS 1.0.0 through 1.9.1 allows an authenticated user to read or modify sensitive resources belonging to other users by manipulating object identifiers. The flaw carries a CVSS 8.1 (High) rating due to high confidentiality and integrity impact over the network, though EPSS exploitation probability remains low at 0.04% and there is no public exploit identified at time of analysis. SSVC classifies exploitation as 'none' but flags the issue as automatable with partial technical impact, indicating defenders should still prioritize patching given the trivial attack complexity.
Path traversal in IBM Langflow OSS 1.0.0 through 1.12.2 lets a remote attacker who holds a valid Langflow account read files outside the intended restricted directory, exposing sensitive data at high confidentiality impact (CVSS 6.5, CWE-22). The flaw is network-reachable, low-complexity and requires no victim interaction, but it cannot be triggered anonymously: the CVSS vector (PR:L) means the attacker must already be able to authenticate to the instance, so risk concentrates on internet-exposed or multi-tenant deployments with loose account provisioning. IBM has published a vendor patch (referenced in its support advisory), and no public exploit code was identified at time of analysis; no KEV listing was provided in the intelligence for this CVE.
Information disclosure in IBM Langflow OSS 1.0.0 through 1.12.2 allows a remote, authenticated attacker holding only low-privilege credentials to obtain sensitive information that should not be reachable from their account, resulting in a high confidentiality impact with no effect on integrity or availability. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) confirms credentials are required and that no user interaction is needed, while the scope-change metric indicates the exposed data can affect resources beyond the vulnerable component itself. Patch available per vendor advisory; no public exploit identified at time of analysis, and no CISA KEV or EPSS signal was provided. This is a credible mid-tier priority rather than an emergency, and the practical risk hinges on how many low-privilege accounts exist and whether the instance is reachable from untrusted networks.
Authenticated users of IBM Langflow OSS 1.0.0 through 1.12.2 can exhaust server resources by supplying a crafted ZIP archive to a code path that performs extraction, degrading or halting availability of the affected instance (CVSS 3.1 base 4.3, CWE-400). The flaw is reachable over the network by a low-privilege authenticated attacker (AV:N/PR:L/UI:N) and is limited to availability impact (C:N/I:N/A:L), with no data exposure, integrity loss, or code execution demonstrated. This is a low-to-moderate priority issue, not an urgent one: it is not confirmed as actively exploited (no CISA KEV listing) and no public exploit code has been identified at time of analysis, though the mandatory credential requirement means exposure is confined to deployments with reachable ZIP-extraction functionality.
Path traversal in IBM Langflow OSS 1.0.0 through 1.12.2 allows an authenticated remote attacker to read files outside the intended directory, causing high-impact confidentiality loss (CVSS 6.5, C:H/I:N/A:N) without modifying data or disrupting service. Exploitation requires low-privileged credentials (PR:L) but is network-reachable, low-complexity, and needs no user interaction, so multi-tenant or self-registration deployments face elevated risk because obtaining an account is trivial; the flaw is a moderate-severity information-disclosure issue with middle-tier real-world priority. No public exploit code or confirmed active exploitation is identified at time of analysis, and IBM has published a vendor patch advisory.
Information disclosure in IBM Langflow OSS versions 1.0.0 through 1.12.2 allows a remote authenticated attacker with only low-level privileges to obtain sensitive information, because authorization checks are not properly enforced on certain resources. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) confirms network reachability and low attack complexity but also that a valid account is a prerequisite, so unauthenticated external attackers cannot exploit it directly; there is no integrity or availability impact. At time of analysis there is no public exploit identified, and the primary risk is for multi-tenant or publicly registrable Langflow deployments where obtaining a low-privileged account is trivial. IBM has published a vendor advisory covering this issue.
Low-privileged authenticated users of IBM Langflow OSS 1.0.0 through 1.12.2 can retrieve credentials that the platform fails to protect adequately, exposing stored secrets such as integration keys and API tokens to any account holder on the instance. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, base 7.7 High) confirms a network-reachable flaw requiring only low privileges and no user interaction, with a scope change and high confidentiality impact but no integrity or availability effect. Exploitation requires a valid authenticated session, which rules out anonymous internet attacks; no public exploit has been identified at time of analysis and IBM has published fixes via its support advisory, so the highest residual risk sits in multi-user or multi-tenant deployments where low-trust accounts coexist with high-value stored credentials.
Authenticated path traversal in IBM Langflow OSS 1.0.0 through 1.12.2 lets a remote attacker who already holds a valid low-privilege account or session reach files outside the intended restricted directory, exposing sensitive information hosted on or reachable from the Langflow instance (CWE-22). The flaw is network-reachable with low attack complexity and no user interaction required, but it is explicitly not unauthenticated - an attacker must first be able to log in, so internet-exposed deployments with self-service registration or shared credentials carry the greatest realistic risk. At the time of analysis no public exploit code has been identified and there is no confirmed active exploitation (not in CISA KEV); IBM has published a fix through its support advisory.
Improper cache key isolation in IBM Langflow OSS versions 1.0.0 through 1.11.5 allows an authenticated attacker to read and potentially manipulate another user's MCP (Model Context Protocol) server context by exploiting shared cache entries that are not scoped to individual user sessions. The MCP Tools component fails to include sufficient user-identity signals in cache keys, permitting cross-user context leakage. A vendor patch is available and no public exploit or KEV listing has been identified at time of analysis.
Server-side request forgery in IBM Langflow OSS 1.0.0 through 1.10.2 enables unauthenticated remote attackers to coerce the application server into issuing arbitrary outbound HTTP requests. Exploiting this flaw, an attacker can probe internal network topology, reach cloud metadata endpoints (e.g., AWS IMDSv1), or use the server as a proxy to bypass network access controls. No public exploit code or CISA KEV listing has been identified at time of analysis, and IBM has released a patch via their support portal.
Server-side request forgery in IBM Langflow OSS versions 1.0.0 through 1.11.2 allows authenticated network attackers to induce the server to issue unauthorized HTTP requests to arbitrary destinations, enabling internal network enumeration or use of the server as a proxy to reach otherwise-isolated services. The vulnerability is classified as CWE-918 and is confirmed by IBM with a patch available at the vendor support page. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Server-side request forgery in IBM Langflow OSS 1.0.0 through 1.11.5 permits unauthenticated remote attackers to cause the application server to issue arbitrary outbound HTTP requests. The primary risk is internal network enumeration - mapping services, ports, and hosts reachable from the Langflow deployment that are otherwise inaccessible to the external attacker - and potential use as a pivot to reach internal APIs or cloud metadata endpoints. No public exploit code exists and the CVE is not in the CISA KEV catalog; IBM has issued a patch via its support portal.
An improper authentication flaw (CWE-287) in IBM Langflow OSS versions 1.0.0 through 1.10.2 lets a remote attacker who already holds a valid low-privileged account change the password of another user's account, resulting in account takeover rather than direct code execution. The CVSS 3.1 score is 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L), reflecting that exploitation requires an authenticated session and primarily damages integrity and availability of the targeted account. No public exploit code has been identified and the issue is not listed in CISA KEV, but SSVC flags partial technical impact and the vendor has published a fix; the exact patched version string is not enumerated in the available data.
Server-Side Request Forgery (SSRF) in IBM Langflow OSS 1.0.0-1.11.5 allows remote authenticated attackers to make the server issue outbound HTTP requests to attacker-controlled or internal endpoints, leaking sensitive information from otherwise inaccessible systems. The scope-changed CVSS vector (S:C) confirms the vulnerability's reach extends beyond the Langflow application itself to adjacent internal infrastructure. IBM has released a patch and no public exploit code has been identified at time of analysis.
Arbitrary file read in IBM Langflow OSS 1.0.0 through 1.11.5 allows a remote authenticated attacker to access files outside their authorized scope due to improper access control (CWE-284). The CVSS vector confirms PR:L, meaning exploitation requires valid credentials but no elevated privileges, making this a post-authentication authorization flaw rather than an authentication bypass. No public exploit has been identified at time of analysis, and a vendor patch is available at IBM support node 7286657.
Cross-user file disclosure in IBM Langflow OSS 1.0.0-1.11.5 allows any authenticated low-privileged user to read files uploaded by other users by supplying arbitrary storage path identifiers in flow component inputs. The File/Read File component, when invoked via the /api/v1/run/advanced/{flow_id} endpoint, accepts user or flow storage namespace identifiers without verifying the requester owns the referenced namespace - a classic IDOR (CWE-639). No public exploit code has been identified at time of analysis, and IBM has released a patch.
Path traversal in IBM Langflow OSS versions 1.0.0 through 1.10.2 allows an authenticated low-privileged attacker to read arbitrary files on the underlying server by injecting dot-dot sequences (/../) into crafted URL requests. The CVSS 3.1 score of 6.5 (C:H/I:N/A:N) reflects a read-only disclosure vector with no write or denial-of-service capability, but the confidentiality impact is materially significant given that Langflow deployments commonly store LLM API keys, pipeline configurations, and model secrets on the host filesystem. No public exploit code or CISA KEV listing has been identified; IBM has released a patch via its support portal.
Path traversal in IBM Langflow OSS 1.0.0-1.10.2 permits authenticated remote attackers to read arbitrary files on the underlying server by embedding dot-dot sequences (/../) in crafted URL requests. The vulnerability (CWE-22) exposes any file readable by the application process, potentially including configuration files, credentials, private keys, and other sensitive data. No public exploit code or active exploitation has been identified at time of analysis; IBM has released a patch.
Path traversal in IBM Langflow OSS 1.0.0 through 1.10.2 exposes arbitrary server-side files to authenticated remote attackers, yielding high confidentiality impact with no integrity or availability loss. The CWE-22 flaw stems from insufficient restriction of user-supplied pathnames, allowing traversal sequences to escape the intended directory boundary. IBM self-reported and patched this issue; no public exploit or active exploitation has been identified at time of analysis.
Server-side request forgery in IBM Langflow OSS 1.0.0 through 1.10.2 allows remote authenticated attackers to force the application server to make outbound HTTP requests to arbitrary destinations, enabling reconnaissance of internal network resources and metadata services. The S:C (scope change) in the CVSS vector confirms the vulnerability can reach internal systems beyond the Langflow application boundary - a hallmark of high-impact SSRF. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and IBM has released a patch.
Path traversal in IBM Langflow OSS versions 1.0.0 through 1.11.2 enables authenticated remote attackers to read arbitrary files accessible to the Langflow process, potentially exposing configuration data, credentials, or other sensitive server-side content. The CVSS vector (PR:L) confirms that prior authentication is required, moderating real-world risk relative to unauthenticated flaws. IBM has released a patch, the vulnerability is vendor-reported, and no public exploit or active exploitation has been identified at time of analysis.
Sensitive file disclosure in IBM Langflow OSS 1.0.0 through 1.11.2 allows authenticated remote attackers to read arbitrary files on the server by exploiting improper validation of symbolic links. The flaw, classified under CWE-22 (Path Traversal), enables an attacker with valid credentials to escape intended directory boundaries by manipulating symlink resolution, potentially exposing configuration files, credentials, or other sensitive server-side content. IBM has released a patch via their support advisory; no public exploit code or active exploitation has been identified at time of analysis.
Arbitrary file write in IBM Langflow OSS 1.0.0-1.11.2 allows low-privileged authenticated attackers to plant files at any server-writable path via the SaveToFileComponent's unsanitized path handling on the /api/v1/run/{flow_id} endpoint. The root cause is CWE-22 path traversal: user-supplied path values-including absolute paths and traversal sequences such as ../../-are incorporated into local filesystem operations without sufficient sanitization. Successful exploitation enables unauthorized file creation or modification, with potential for further compromise (e.g., overwriting application scripts or configuration) depending on the Langflow process's file-system permissions. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stored cross-site scripting in IBM Langflow OSS 1.0.0-1.11.2 allows an unauthenticated network attacker to inject persistent malicious scripts into the Playground chat interface. When a victim user subsequently loads the chat view, the stored payload executes in their browser under the application's origin, enabling session hijacking, credential theft, or unauthorized UI manipulation. IBM has released a patch per advisory node/7285646; no public exploit code or CISA KEV listing has been identified at time of analysis.
Arbitrary IDE configuration file writes in IBM Langflow OSS 1.0.0 through 1.11.2 are achievable by authenticated remote attackers who spoof the X-Forwarded-For HTTP header to impersonate a localhost connection, bypassing the platform's IP-based restriction on MCP (Model Context Protocol) server configuration installation. The direct impact is unauthorized writes to files such as ~/.cursor/mcp.json, which define MCP server endpoints loaded by AI-integrated IDEs; a malicious entry in these files can redirect the IDE to an attacker-controlled MCP server, enabling downstream code execution within the developer's environment. No public exploit has been identified at time of analysis; a vendor-released patch is available per IBM advisory 7285646.
Broken object-level authorization in IBM Langflow OSS 1.0.0 through 1.11.1 allows any authenticated network user to read and execute private flows belonging to other users. The flaw (CWE-639) stems from the application accepting user-controlled flow identifiers in API requests without verifying that the requesting account owns the targeted resource - a classic horizontal privilege escalation path. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but a vendor patch is available via IBM Security Advisory.
Server-side request forgery in IBM Langflow OSS 1.0.0 through 1.11.1 allows an authenticated low-privilege attacker to coerce the application server into issuing arbitrary outbound HTTP requests, enabling internal network enumeration and potentially pivoting to other attacks against backend infrastructure. The CVSS vector (PR:L/AV:N/AC:L) confirms this is exploitable over the network by any authenticated user without elevated permissions or user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis; IBM has released a patch via their support portal.
Path traversal in IBM Langflow OSS 1.0.0-1.10.3 allows authenticated low-privilege network attackers to inject directory traversal sequences into the username field, bypassing containment checks. Successful exploitation enables arbitrary directory deletion, cross-tenant data destruction, and deletion of JWT signing keys - the last of which forces platform-wide session invalidation for all users. No public exploit or CISA KEV listing has been identified at time of analysis, though the operational impact in multi-tenant deployments is severe despite the moderate CVSS score of 6.5.
Arbitrary file write via path traversal in IBM Langflow OSS 1.0.0-1.10.3 allows any authenticated user to create directories and write files to arbitrary locations on the server filesystem through the Knowledge Bases API. The flaw stems from unsanitized user-supplied knowledge base names being passed directly into file path construction, making exploitation straightforward once credentials are obtained. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor patch is available.
Authenticated users in IBM Langflow OSS 1.0.0 through 1.10.3 can exploit a privileged built-in component to read arbitrary server-side environment variables, bypassing security controls designed to restrict custom component execution. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H) confirms this is a low-complexity, network-accessible flaw requiring only standard user credentials, with high confidentiality impact. No active exploitation confirmed via CISA KEV, and no public exploit code has been identified at time of analysis; IBM has released a patch via its support portal.
Server-side request forgery in IBM Langflow OSS 1.0.0 through 1.10.3 allows low-privileged authenticated users to force the server to make arbitrary outbound HTTP requests to internal or restricted network destinations due to incomplete enforcement of the platform's built-in SSRF protections. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms network-reachable exploitation at low complexity with high confidentiality impact, making cloud metadata endpoints and internal services realistic targets. No public exploit has been identified at time of analysis, and no active exploitation has been confirmed by CISA KEV.
Path traversal in IBM Langflow OSS 1.0.0-1.10.3 exposes arbitrary server filesystem files via a crafted MCP `resources/read` request using URL-encoded traversal sequences. Authenticated low-privilege users can read other users' uploaded documents, the JWT signing secret, the SQLite database, and process environment variables - leaking the JWT secret effectively enables token forgery and full account takeover beyond what the CVSS 6.5 score implies. No public exploit identified at time of analysis; vendor patch is available per IBM advisory.
Broken access control in IBM Langflow OSS 1.0.0-1.8.4 exposes private flow files through two distinct endpoint flaws: the image retrieval endpoint enforces no authentication whatsoever, allowing unauthenticated remote attackers to access any user's image files given a valid flow ID and filename; separately, the file download endpoint, while requiring authentication, fails to validate resource ownership, enabling any authenticated user to access files belonging to other tenants via IDOR. Both flaws break tenant isolation in multi-user deployments and result in unauthorized disclosure of sensitive data. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor patch is available.
Server-side request forgery in IBM Langflow OSS (versions 1.0.0 through 1.10.0, and Langflow 1.9.0) allows an authenticated low-privileged user to coerce the server into making attacker-controlled outbound requests, reaching internal services and exfiltrating their responses. The flaw stems from an insecure default configuration combined with incomplete enforcement of the built-in SSRF protection, meaning the safeguard can be bypassed. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though a vendor patch is available.
Unauthenticated remote code execution in IBM Langflow OSS versions 1.0.0 through 1.9.3 allows attackers to fully compromise the host by bypassing authentication and abusing improper Python execution isolation. The maximum CVSS 10.0 score (AV:N/AC:L/PR:N/UI:N with scope change) reflects trivial network-based exploitation against any internet-exposed instance, though no public exploit identified at time of analysis. IBM has confirmed the issue and released a patch via support advisory node/7277242.
Insecure direct object reference (IDOR) in IBM Langflow OSS 1.0.0 through 1.9.1 allows an authenticated user to read or modify sensitive resources belonging to other users by manipulating object identifiers. The flaw carries a CVSS 8.1 (High) rating due to high confidentiality and integrity impact over the network, though EPSS exploitation probability remains low at 0.04% and there is no public exploit identified at time of analysis. SSVC classifies exploitation as 'none' but flags the issue as automatable with partial technical impact, indicating defenders should still prioritize patching given the trivial attack complexity.
Path traversal in IBM Langflow OSS 1.0.0 through 1.12.2 lets a remote attacker who holds a valid Langflow account read files outside the intended restricted directory, exposing sensitive data at high confidentiality impact (CVSS 6.5, CWE-22). The flaw is network-reachable, low-complexity and requires no victim interaction, but it cannot be triggered anonymously: the CVSS vector (PR:L) means the attacker must already be able to authenticate to the instance, so risk concentrates on internet-exposed or multi-tenant deployments with loose account provisioning. IBM has published a vendor patch (referenced in its support advisory), and no public exploit code was identified at time of analysis; no KEV listing was provided in the intelligence for this CVE.
Information disclosure in IBM Langflow OSS 1.0.0 through 1.12.2 allows a remote, authenticated attacker holding only low-privilege credentials to obtain sensitive information that should not be reachable from their account, resulting in a high confidentiality impact with no effect on integrity or availability. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) confirms credentials are required and that no user interaction is needed, while the scope-change metric indicates the exposed data can affect resources beyond the vulnerable component itself. Patch available per vendor advisory; no public exploit identified at time of analysis, and no CISA KEV or EPSS signal was provided. This is a credible mid-tier priority rather than an emergency, and the practical risk hinges on how many low-privilege accounts exist and whether the instance is reachable from untrusted networks.
Authenticated users of IBM Langflow OSS 1.0.0 through 1.12.2 can exhaust server resources by supplying a crafted ZIP archive to a code path that performs extraction, degrading or halting availability of the affected instance (CVSS 3.1 base 4.3, CWE-400). The flaw is reachable over the network by a low-privilege authenticated attacker (AV:N/PR:L/UI:N) and is limited to availability impact (C:N/I:N/A:L), with no data exposure, integrity loss, or code execution demonstrated. This is a low-to-moderate priority issue, not an urgent one: it is not confirmed as actively exploited (no CISA KEV listing) and no public exploit code has been identified at time of analysis, though the mandatory credential requirement means exposure is confined to deployments with reachable ZIP-extraction functionality.
Path traversal in IBM Langflow OSS 1.0.0 through 1.12.2 allows an authenticated remote attacker to read files outside the intended directory, causing high-impact confidentiality loss (CVSS 6.5, C:H/I:N/A:N) without modifying data or disrupting service. Exploitation requires low-privileged credentials (PR:L) but is network-reachable, low-complexity, and needs no user interaction, so multi-tenant or self-registration deployments face elevated risk because obtaining an account is trivial; the flaw is a moderate-severity information-disclosure issue with middle-tier real-world priority. No public exploit code or confirmed active exploitation is identified at time of analysis, and IBM has published a vendor patch advisory.
Information disclosure in IBM Langflow OSS versions 1.0.0 through 1.12.2 allows a remote authenticated attacker with only low-level privileges to obtain sensitive information, because authorization checks are not properly enforced on certain resources. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) confirms network reachability and low attack complexity but also that a valid account is a prerequisite, so unauthenticated external attackers cannot exploit it directly; there is no integrity or availability impact. At time of analysis there is no public exploit identified, and the primary risk is for multi-tenant or publicly registrable Langflow deployments where obtaining a low-privileged account is trivial. IBM has published a vendor advisory covering this issue.
Low-privileged authenticated users of IBM Langflow OSS 1.0.0 through 1.12.2 can retrieve credentials that the platform fails to protect adequately, exposing stored secrets such as integration keys and API tokens to any account holder on the instance. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, base 7.7 High) confirms a network-reachable flaw requiring only low privileges and no user interaction, with a scope change and high confidentiality impact but no integrity or availability effect. Exploitation requires a valid authenticated session, which rules out anonymous internet attacks; no public exploit has been identified at time of analysis and IBM has published fixes via its support advisory, so the highest residual risk sits in multi-user or multi-tenant deployments where low-trust accounts coexist with high-value stored credentials.
Authenticated path traversal in IBM Langflow OSS 1.0.0 through 1.12.2 lets a remote attacker who already holds a valid low-privilege account or session reach files outside the intended restricted directory, exposing sensitive information hosted on or reachable from the Langflow instance (CWE-22). The flaw is network-reachable with low attack complexity and no user interaction required, but it is explicitly not unauthenticated - an attacker must first be able to log in, so internet-exposed deployments with self-service registration or shared credentials carry the greatest realistic risk. At the time of analysis no public exploit code has been identified and there is no confirmed active exploitation (not in CISA KEV); IBM has published a fix through its support advisory.
Improper cache key isolation in IBM Langflow OSS versions 1.0.0 through 1.11.5 allows an authenticated attacker to read and potentially manipulate another user's MCP (Model Context Protocol) server context by exploiting shared cache entries that are not scoped to individual user sessions. The MCP Tools component fails to include sufficient user-identity signals in cache keys, permitting cross-user context leakage. A vendor patch is available and no public exploit or KEV listing has been identified at time of analysis.
Server-side request forgery in IBM Langflow OSS 1.0.0 through 1.10.2 enables unauthenticated remote attackers to coerce the application server into issuing arbitrary outbound HTTP requests. Exploiting this flaw, an attacker can probe internal network topology, reach cloud metadata endpoints (e.g., AWS IMDSv1), or use the server as a proxy to bypass network access controls. No public exploit code or CISA KEV listing has been identified at time of analysis, and IBM has released a patch via their support portal.
Server-side request forgery in IBM Langflow OSS versions 1.0.0 through 1.11.2 allows authenticated network attackers to induce the server to issue unauthorized HTTP requests to arbitrary destinations, enabling internal network enumeration or use of the server as a proxy to reach otherwise-isolated services. The vulnerability is classified as CWE-918 and is confirmed by IBM with a patch available at the vendor support page. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Server-side request forgery in IBM Langflow OSS 1.0.0 through 1.11.5 permits unauthenticated remote attackers to cause the application server to issue arbitrary outbound HTTP requests. The primary risk is internal network enumeration - mapping services, ports, and hosts reachable from the Langflow deployment that are otherwise inaccessible to the external attacker - and potential use as a pivot to reach internal APIs or cloud metadata endpoints. No public exploit code exists and the CVE is not in the CISA KEV catalog; IBM has issued a patch via its support portal.
An improper authentication flaw (CWE-287) in IBM Langflow OSS versions 1.0.0 through 1.10.2 lets a remote attacker who already holds a valid low-privileged account change the password of another user's account, resulting in account takeover rather than direct code execution. The CVSS 3.1 score is 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L), reflecting that exploitation requires an authenticated session and primarily damages integrity and availability of the targeted account. No public exploit code has been identified and the issue is not listed in CISA KEV, but SSVC flags partial technical impact and the vendor has published a fix; the exact patched version string is not enumerated in the available data.
Server-Side Request Forgery (SSRF) in IBM Langflow OSS 1.0.0-1.11.5 allows remote authenticated attackers to make the server issue outbound HTTP requests to attacker-controlled or internal endpoints, leaking sensitive information from otherwise inaccessible systems. The scope-changed CVSS vector (S:C) confirms the vulnerability's reach extends beyond the Langflow application itself to adjacent internal infrastructure. IBM has released a patch and no public exploit code has been identified at time of analysis.
Arbitrary file read in IBM Langflow OSS 1.0.0 through 1.11.5 allows a remote authenticated attacker to access files outside their authorized scope due to improper access control (CWE-284). The CVSS vector confirms PR:L, meaning exploitation requires valid credentials but no elevated privileges, making this a post-authentication authorization flaw rather than an authentication bypass. No public exploit has been identified at time of analysis, and a vendor patch is available at IBM support node 7286657.
Cross-user file disclosure in IBM Langflow OSS 1.0.0-1.11.5 allows any authenticated low-privileged user to read files uploaded by other users by supplying arbitrary storage path identifiers in flow component inputs. The File/Read File component, when invoked via the /api/v1/run/advanced/{flow_id} endpoint, accepts user or flow storage namespace identifiers without verifying the requester owns the referenced namespace - a classic IDOR (CWE-639). No public exploit code has been identified at time of analysis, and IBM has released a patch.
Path traversal in IBM Langflow OSS versions 1.0.0 through 1.10.2 allows an authenticated low-privileged attacker to read arbitrary files on the underlying server by injecting dot-dot sequences (/../) into crafted URL requests. The CVSS 3.1 score of 6.5 (C:H/I:N/A:N) reflects a read-only disclosure vector with no write or denial-of-service capability, but the confidentiality impact is materially significant given that Langflow deployments commonly store LLM API keys, pipeline configurations, and model secrets on the host filesystem. No public exploit code or CISA KEV listing has been identified; IBM has released a patch via its support portal.
Path traversal in IBM Langflow OSS 1.0.0-1.10.2 permits authenticated remote attackers to read arbitrary files on the underlying server by embedding dot-dot sequences (/../) in crafted URL requests. The vulnerability (CWE-22) exposes any file readable by the application process, potentially including configuration files, credentials, private keys, and other sensitive data. No public exploit code or active exploitation has been identified at time of analysis; IBM has released a patch.
Path traversal in IBM Langflow OSS 1.0.0 through 1.10.2 exposes arbitrary server-side files to authenticated remote attackers, yielding high confidentiality impact with no integrity or availability loss. The CWE-22 flaw stems from insufficient restriction of user-supplied pathnames, allowing traversal sequences to escape the intended directory boundary. IBM self-reported and patched this issue; no public exploit or active exploitation has been identified at time of analysis.
Server-side request forgery in IBM Langflow OSS 1.0.0 through 1.10.2 allows remote authenticated attackers to force the application server to make outbound HTTP requests to arbitrary destinations, enabling reconnaissance of internal network resources and metadata services. The S:C (scope change) in the CVSS vector confirms the vulnerability can reach internal systems beyond the Langflow application boundary - a hallmark of high-impact SSRF. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and IBM has released a patch.
Path traversal in IBM Langflow OSS versions 1.0.0 through 1.11.2 enables authenticated remote attackers to read arbitrary files accessible to the Langflow process, potentially exposing configuration data, credentials, or other sensitive server-side content. The CVSS vector (PR:L) confirms that prior authentication is required, moderating real-world risk relative to unauthenticated flaws. IBM has released a patch, the vulnerability is vendor-reported, and no public exploit or active exploitation has been identified at time of analysis.
Sensitive file disclosure in IBM Langflow OSS 1.0.0 through 1.11.2 allows authenticated remote attackers to read arbitrary files on the server by exploiting improper validation of symbolic links. The flaw, classified under CWE-22 (Path Traversal), enables an attacker with valid credentials to escape intended directory boundaries by manipulating symlink resolution, potentially exposing configuration files, credentials, or other sensitive server-side content. IBM has released a patch via their support advisory; no public exploit code or active exploitation has been identified at time of analysis.
Arbitrary file write in IBM Langflow OSS 1.0.0-1.11.2 allows low-privileged authenticated attackers to plant files at any server-writable path via the SaveToFileComponent's unsanitized path handling on the /api/v1/run/{flow_id} endpoint. The root cause is CWE-22 path traversal: user-supplied path values-including absolute paths and traversal sequences such as ../../-are incorporated into local filesystem operations without sufficient sanitization. Successful exploitation enables unauthorized file creation or modification, with potential for further compromise (e.g., overwriting application scripts or configuration) depending on the Langflow process's file-system permissions. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stored cross-site scripting in IBM Langflow OSS 1.0.0-1.11.2 allows an unauthenticated network attacker to inject persistent malicious scripts into the Playground chat interface. When a victim user subsequently loads the chat view, the stored payload executes in their browser under the application's origin, enabling session hijacking, credential theft, or unauthorized UI manipulation. IBM has released a patch per advisory node/7285646; no public exploit code or CISA KEV listing has been identified at time of analysis.
Arbitrary IDE configuration file writes in IBM Langflow OSS 1.0.0 through 1.11.2 are achievable by authenticated remote attackers who spoof the X-Forwarded-For HTTP header to impersonate a localhost connection, bypassing the platform's IP-based restriction on MCP (Model Context Protocol) server configuration installation. The direct impact is unauthorized writes to files such as ~/.cursor/mcp.json, which define MCP server endpoints loaded by AI-integrated IDEs; a malicious entry in these files can redirect the IDE to an attacker-controlled MCP server, enabling downstream code execution within the developer's environment. No public exploit has been identified at time of analysis; a vendor-released patch is available per IBM advisory 7285646.
Broken object-level authorization in IBM Langflow OSS 1.0.0 through 1.11.1 allows any authenticated network user to read and execute private flows belonging to other users. The flaw (CWE-639) stems from the application accepting user-controlled flow identifiers in API requests without verifying that the requesting account owns the targeted resource - a classic horizontal privilege escalation path. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but a vendor patch is available via IBM Security Advisory.
Server-side request forgery in IBM Langflow OSS 1.0.0 through 1.11.1 allows an authenticated low-privilege attacker to coerce the application server into issuing arbitrary outbound HTTP requests, enabling internal network enumeration and potentially pivoting to other attacks against backend infrastructure. The CVSS vector (PR:L/AV:N/AC:L) confirms this is exploitable over the network by any authenticated user without elevated permissions or user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis; IBM has released a patch via their support portal.
Path traversal in IBM Langflow OSS 1.0.0-1.10.3 allows authenticated low-privilege network attackers to inject directory traversal sequences into the username field, bypassing containment checks. Successful exploitation enables arbitrary directory deletion, cross-tenant data destruction, and deletion of JWT signing keys - the last of which forces platform-wide session invalidation for all users. No public exploit or CISA KEV listing has been identified at time of analysis, though the operational impact in multi-tenant deployments is severe despite the moderate CVSS score of 6.5.
Arbitrary file write via path traversal in IBM Langflow OSS 1.0.0-1.10.3 allows any authenticated user to create directories and write files to arbitrary locations on the server filesystem through the Knowledge Bases API. The flaw stems from unsanitized user-supplied knowledge base names being passed directly into file path construction, making exploitation straightforward once credentials are obtained. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor patch is available.
Authenticated users in IBM Langflow OSS 1.0.0 through 1.10.3 can exploit a privileged built-in component to read arbitrary server-side environment variables, bypassing security controls designed to restrict custom component execution. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H) confirms this is a low-complexity, network-accessible flaw requiring only standard user credentials, with high confidentiality impact. No active exploitation confirmed via CISA KEV, and no public exploit code has been identified at time of analysis; IBM has released a patch via its support portal.
Server-side request forgery in IBM Langflow OSS 1.0.0 through 1.10.3 allows low-privileged authenticated users to force the server to make arbitrary outbound HTTP requests to internal or restricted network destinations due to incomplete enforcement of the platform's built-in SSRF protections. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms network-reachable exploitation at low complexity with high confidentiality impact, making cloud metadata endpoints and internal services realistic targets. No public exploit has been identified at time of analysis, and no active exploitation has been confirmed by CISA KEV.
Path traversal in IBM Langflow OSS 1.0.0-1.10.3 exposes arbitrary server filesystem files via a crafted MCP `resources/read` request using URL-encoded traversal sequences. Authenticated low-privilege users can read other users' uploaded documents, the JWT signing secret, the SQLite database, and process environment variables - leaking the JWT secret effectively enables token forgery and full account takeover beyond what the CVSS 6.5 score implies. No public exploit identified at time of analysis; vendor patch is available per IBM advisory.
Broken access control in IBM Langflow OSS 1.0.0-1.8.4 exposes private flow files through two distinct endpoint flaws: the image retrieval endpoint enforces no authentication whatsoever, allowing unauthenticated remote attackers to access any user's image files given a valid flow ID and filename; separately, the file download endpoint, while requiring authentication, fails to validate resource ownership, enabling any authenticated user to access files belonging to other tenants via IDOR. Both flaws break tenant isolation in multi-user deployments and result in unauthorized disclosure of sensitive data. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor patch is available.
Server-side request forgery in IBM Langflow OSS (versions 1.0.0 through 1.10.0, and Langflow 1.9.0) allows an authenticated low-privileged user to coerce the server into making attacker-controlled outbound requests, reaching internal services and exfiltrating their responses. The flaw stems from an insecure default configuration combined with incomplete enforcement of the built-in SSRF protection, meaning the safeguard can be bypassed. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though a vendor patch is available.