Langflow Oss
Approved changes feed: RSS · Atom
cpe:2.3:a:ibm:langflow_oss:1.10.1:*:*:*:*:*:*:*
part: a version: 1.10.1 update: *
| Vendor | Ibm (177c0602-9232-5933-8f2f-9d22f079d22d) |
|---|---|
| Product | Langflow Oss (76f13290-9e1a-5502-bd5b-80373b8c1904) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-12940 |
vulnerable | 2026-09-16 04:32:51.692131 |
Langflow is affected by remote code execution due to multiple unauthenticated and insufficiently authorized API endpoints
CRITICAL (9.8)
IBM Langflow OSS 1.0.0 through 1.10.1 are vulnerable to unauthenticated remote code execution via environment variable injection in the MCP (Model Context Protocol) stdio launcher. The vulnerability exists in src/lfx/src/lfx/base/mcp/util.py where the DANGEROUS_ENV_VARS blocklist fails to include SHELLOPTS , BASHOPTS , and PS4 environment variables.
Published: 2026-07-30T16:41:54.216Z
Updated: 2026-07-31T03:56:16.617Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-12945 |
vulnerable | 2026-09-16 04:32:51.343113 |
Langflow is affected by exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints
HIGH (7.1)
IBM Langflow OSS 1.0.0 through 1.10.1 allows authenticated users to access and manipulate other users' build jobs through improper access control on log retrieval and unauthenticated build endpoints.
Published: 2026-07-30T16:44:39.380Z
Updated: 2026-07-31T22:59:08.271Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-13442 |
vulnerable | 2026-09-16 04:32:50.456337 |
Langflow is affected by NET Misconfiguration: Use of Impersonation due to multiple unauthenticated and insufficiently authorized API endpoints
HIGH (7.1)
IBM Langflow OSS 1.0.0 through 1.10.1 can allow an attacker to reuse another user's FAISS namespace to access owner-only vector content and influence later query results. This causes cross-user information disclosure and limited integrity impact through persistent poisoning of returned results.
Published: 2026-07-28T20:55:24.930Z
Updated: 2026-07-29T14:11:30.129Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-13435 |
vulnerable | 2026-09-16 04:32:50.277426 |
Python Interpreter Sandbox Bypass Leading to Sensitive Data Exposure
CRITICAL (9.9)
IBM Langflow OSS 1.0.0 through 1.10.1 contains an improper input validation vulnerability in the PythonREPL sandbox implementation.
Published: 2026-07-30T16:48:36.764Z
Updated: 2026-07-31T03:56:17.304Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-13444 |
vulnerable | 2026-09-16 04:32:49.950942 |
Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints
IBM Langflow OSS 1.0.0 through 1.10.1 can allow an attacker to access another user's private vector documents by creating their own flow with matching Chroma persist_directory and collection_name values. The attacker receives exact victim content in their workflow output despite having no authorization to read the victim's flow. Additionally, the attacker can pollute the victim's collection by inserting their own documents into the shared namespace.
Published: 2026-07-30T18:38:32.531Z
Updated: 2026-07-30T19:21:21.684Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-14499 |
vulnerable | 2026-07-29 00:26:17.071586 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-13448 |
vulnerable | 2026-07-29 00:23:33.049590 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-13446 |
vulnerable | 2026-07-29 00:23:33.048910 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-13445 |
vulnerable | 2026-07-29 00:23:33.048186 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.