{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/langflow-oss/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Langflow OSS"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Langflow"],"content_html":"\u003cp\u003eThe BSI has released a security advisory regarding multiple vulnerabilities identified within the open-source Langflow OSS platform. These vulnerabilities pose significant risks, as successful exploitation enables attackers to bypass existing security mechanisms, disclose sensitive information, and perform unauthorized data manipulation within the target environment. Given that Langflow is often used to orchestrate AI workflows and interact with sensitive LLM-related data, the impact of these flaws could include the compromise of credentials, API keys, and internal workflows. Defenders should audit their Langflow deployments, restrict network exposure, and monitor for unauthorized access to the application's administrative and data management endpoints. As specific CVE identifiers and technical exploitation details are currently limited, administrators should prioritize keeping the application updated to the latest available version provided by the Langflow project.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of these vulnerabilities can lead to full confidentiality and integrity loss for the affected Langflow instance. If exposed to the internet, attackers may target the application to gain unauthorized access to backend workflows or internal services integrated via Langflow. The number of impacted systems is currently unknown, but organizations utilizing Langflow OSS for automated data processing or AI application development are at high risk.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAudit existing Langflow OSS deployments for exposure to the public internet and restrict access to trusted management networks immediately.\u003c/li\u003e\n\u003cli\u003eMonitor application logs for anomalous access patterns, particularly around API endpoints and administrative interfaces, to detect potential unauthorized data access or manipulation.\u003c/li\u003e\n\u003cli\u003eApply security updates as soon as they are published by the Langflow development team.\u003c/li\u003e\n\u003cli\u003eReview documentation for configuration hardening to ensure the least privilege is applied to service accounts and integrations managed within Langflow.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-24T21:57:19Z","date_published":"2026-08-24T21:57:19Z","id":"https://feed.craftedsignal.io/briefs/2026-08-langflow-vulnerabilities/","summary":"Langflow OSS contains multiple security flaws that could allow unauthenticated attackers to bypass security controls, exfiltrate sensitive data, and perform unauthorized data manipulation.","title":"Multiple Vulnerabilities in Langflow OSS","url":"https://feed.craftedsignal.io/briefs/2026-08-langflow-vulnerabilities/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.9,"id":"CVE-2026-9135"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Langflow OSS"],"_cs_severities":["critical"],"_cs_tags":["code-injection","vulnerability","rce","langflow","hard-coded-credentials","ibm"],"_cs_type":"advisory","_cs_vendors":["IBM"],"content_html":"\u003cp\u003eCVE-2026-9135 describes a critical code injection vulnerability affecting IBM Langflow OSS versions 1.0.0 through 1.10.0, specifically impacting Langflow versions up to 1.9.2 (commit 94981c443d4918517b9e8163d70fc598dc33a32d). This flaw resides in the Policies component's ToolGuard integration, allowing authenticated users with flow creation privileges to bypass the \u003ccode\u003eallow_custom_components=false\u003c/code\u003e security control. The vulnerability stems from an insufficient validation mechanism that only scrutinizes the main component source code (\u003ccode\u003enode_template[\u0026quot;code\u0026quot;][\u0026quot;value\u0026quot;]\u003c/code\u003e) while failing to validate dynamic \u003ccode\u003eCodeInput\u003c/code\u003e fields, which are used to store generated ToolGuard Python files. Attackers can embed malicious Python code within these unvalidated dynamic fields, which is then persisted in \u003ccode\u003eFlow.data\u003c/code\u003e and executed server-side when a guarded tool is invoked via the ToolGuard runtime. This enables arbitrary Python code execution on the backend and can be escalated through cross-tenant flow manipulation using the \u003ccode\u003eupdate_flow_component_field\u003c/code\u003e tool, potentially affecting other users' flows. Under specific misconfigurations (\u003ccode\u003eAUTO_LOGIN=true\u003c/code\u003e, \u003ccode\u003eNEW_USER_IS_ACTIVE=true\u003c/code\u003e), authentication requirements for the attack can be significantly reduced.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn authenticated attacker obtains flow creation privileges within IBM Langflow OSS.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts malicious Python code designed for arbitrary execution on the backend.\u003c/li\u003e\n\u003cli\u003eThe attacker embeds this malicious Python code into dynamic \u003ccode\u003eCodeInput\u003c/code\u003e fields of a Langflow component.\u003c/li\u003e\n\u003cli\u003eThe Langflow Policies component's ToolGuard integration performs an insufficient validation check, only examining the main component source code and bypassing the \u003ccode\u003eallow_custom_components=false\u003c/code\u003e control.\u003c/li\u003e\n\u003cli\u003eThe malicious code embedded in the unvalidated dynamic fields is persisted within \u003ccode\u003eFlow.data\u003c/code\u003e when the flow is saved.\u003c/li\u003e\n\u003cli\u003eWhen a guarded tool within the manipulated flow is subsequently invoked, the ToolGuard runtime executes the malicious Python code server-side.\u003c/li\u003e\n\u003cli\u003eThe attacker can further escalate by utilizing the \u003ccode\u003eagentic MCP update_flow_component_field\u003c/code\u003e tool with attacker-controlled \u003ccode\u003euser_id\u003c/code\u003e parameters to inject malicious code into other victim users' flows, achieving cross-tenant manipulation.\u003c/li\u003e\n\u003cli\u003eIn environments configured with \u003ccode\u003eAUTO_LOGIN=true\u003c/code\u003e and \u003ccode\u003eNEW_USER_IS_ACTIVE=true\u003c/code\u003e, the initial authentication requirements for the attacker may be reduced, broadening the attack surface.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-9135 grants authenticated attackers arbitrary Python code execution on the backend systems running IBM Langflow OSS. This can lead to full compromise of the underlying server, data exfiltration, or further lateral movement within the network. The vulnerability's ability to facilitate cross-tenant flow manipulation through the \u003ccode\u003eupdate_flow_component_field\u003c/code\u003e tool means that an attacker could inject malicious code into other users' environments, impacting data integrity and confidentiality across the platform. Furthermore, specific misconfigurations can lower authentication barriers, potentially increasing the number of vulnerable instances and the ease of exploitation.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately update IBM Langflow OSS to a patched version beyond 1.9.2 or apply the provided security patch for CVE-2026-9135.\u003c/li\u003e\n\u003cli\u003eReview and ensure that the \u003ccode\u003eAUTO_LOGIN\u003c/code\u003e and \u003ccode\u003eNEW_USER_IS_ACTIVE\u003c/code\u003e configurations are set appropriately for your environment to prevent reduced authentication requirements that could facilitate exploitation of CVE-2026-9135.\u003c/li\u003e\n\u003cli\u003eMonitor server-side logs on systems running IBM Langflow OSS for unusual process creations or outbound network connections from the Langflow application process, which could indicate arbitrary Python code execution.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-17T21:19:13Z","date_published":"2026-07-17T19:19:49Z","id":"https://feed.craftedsignal.io/briefs/2026-07-ibm-langflow-code-injection/","summary":"An authenticated attacker can exploit CVE-2026-9135, a code injection vulnerability in IBM Langflow OSS versions 1.0.0 through 1.9.2, to bypass security controls and achieve arbitrary Python code execution on the backend through unvalidated dynamic CodeInput fields in the ToolGuard integration, potentially escalating privileges via cross-tenant flow manipulation.","title":"IBM Langflow OSS Code Injection Vulnerability in ToolGuard (CVE-2026-9135)","url":"https://feed.craftedsignal.io/briefs/2026-07-ibm-langflow-code-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Langflow OSS","version":"https://jsonfeed.org/version/1.1"}