Langflow: IBM Langflow OSS 1.0.0 through 1.11.1 allows an authenticated attacker to execute arbitrary…
Langflow
More for Langflow RSS feed for Langflow
- Severity
- Critical, CVSS 9.9
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Record
- CVE-2026-19295
- Affects
- Langflow
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- August 28, 2026
- Source last modified
- September 1, 2026
Description
IBM Langflow OSS 1.0.0 through 1.11.1 allows an authenticated attacker to execute arbitrary operating system commands in the server process by saving a flow with a crafted type field value and triggering a build of a wrapper flow that references it. This allowed privilege escalation from "authenticated flow user" to arbitrary OS-level command execution under the server process identity, bypassing the LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false policy control.
Description quoted from the NVD record.
Who is affected
Your organization is affected if it runs Langflow (also called IBM Langflow OSS), a tool for building apps that use AI language models, in versions 1.0.0 through 1.11.1. Someone who already has a login and can create workflows could save a specially altered workflow and then start a build of another workflow that uses it. This lets them run any command they choose on the server that hosts Langflow, with the same access as Langflow itself. This works even when Langflow is set to block custom building blocks. This flaw is rated Critical.
What to do
- The person who installed or runs Langflow for your organization should handle this. If an IT provider or vendor runs it for you, send them this advisory and ask when the update will be done.
- Check which version of Langflow you run: versions 1.0.0 through 1.11.1 are affected.
- No fixed version is named for this flaw yet, so check the vendor advisory linked on this page for a fixed release, and install it as soon as it is available.
- Do not count on the setting that blocks custom building blocks to protect you, because this flaw gets around it.
Analysis written from the source record as of September 1, 2026 and reviewed before publishing.