Langflow Oss
Approved changes feed: RSS · Atom
cpe:2.3:a:ibm:langflow_oss:1.10.3:*:*:*:*:*:*:*
part: a version: 1.10.3 update: *
| Vendor | Ibm (177c0602-9232-5933-8f2f-9d22f079d22d) |
|---|---|
| Product | Langflow Oss (76f13290-9e1a-5502-bd5b-80373b8c1904) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-7658 |
vulnerable | 2026-09-16 04:34:10.807868 |
Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement
MEDIUM (6.5)
IBM Langflow OSS 1.0.0 through 1.10.3 does not properly validate the username field, allowing attackers to inject path traversal sequences and bypass containment checks. This enables multiple severe impacts, including arbitrary directory deletion, cross-tenant data destruction, and JWT signing key deletion leading to session invalidation.
Published: 2026-08-05T18:20:40.919Z
Updated: 2026-08-05T19:42:27.629Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-7646 |
vulnerable | 2026-09-16 04:34:10.198632 |
Langflow is affected by security vulnerabilities in Model Context Protocol features
MEDIUM (6.5)
IBM Langflow OSS 1.0.0 through 1.10.3 allows users to read arbitrary files from the server filesystem, including other users' uploaded documents, the JWT signing secret, the SQLite database, and process environment variables, by sending a crafted MCP `resources/read` request with a URL-encoded path traversal sequence in the filename.
Published: 2026-08-05T16:25:39.442Z
Updated: 2026-08-05T17:58:02.171Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-7869 |
vulnerable | 2026-09-16 04:34:10.077957 |
Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement
MEDIUM (5.4)
IBM Langflow OSS 1.0.0 through 1.10.3 is vulnerable to Path Traversal in the Knowledge Bases API (`POST /api/v1/knowledge_bases`). This occurs because user-supplied knowledge base names are used directly to create file paths without proper sanitization or containment checks. An authenticated attacker can exploit this flaw to create directories and write files anywhere on the server's filesystem.
Published: 2026-08-05T18:13:15.979Z
Updated: 2026-08-06T14:34:10.635Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-7657 |
vulnerable | 2026-09-16 04:34:09.823177 |
Langflow OSS is affected by server-side request forgery in provider validation and API request functionality
MEDIUM (6.5)
IBM Langflow OSS 1.0.0 through 1.10.3 Langflow could allow server-side request forgery (SSRF) due to incomplete and ineffective SSRF protection enforcement.
Published: 2026-08-05T17:37:58.336Z
Updated: 2026-08-05T18:03:12.602Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-84889 |
vulnerable | 2026-09-16 04:33:10.346552 |
A path traversal vulnerability in file handling components could allow an authenticated attacker to write files to arbitrary locations on the server filesystem
HIGH (8.8)
IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to improper limitation of a pathname to a restricted directory.
Published: 2026-09-10T21:25:05.025Z
Updated: 2026-09-12T15:36:04.812Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-17630 |
vulnerable | 2026-09-16 04:33:03.989363 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-17624 |
vulnerable | 2026-09-16 04:33:03.795741 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-17625 |
vulnerable | 2026-09-16 04:33:03.631285 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-17623 |
vulnerable | 2026-09-16 04:33:03.269807 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-17633 |
vulnerable | 2026-09-16 04:33:03.062990 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-17632 |
vulnerable | 2026-09-16 04:33:02.852196 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-17626 |
vulnerable | 2026-09-16 04:33:02.645707 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-9081 |
vulnerable | 2026-09-16 04:33:02.532830 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-9130 |
vulnerable | 2026-09-16 04:33:02.410656 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-9196 |
vulnerable | 2026-09-16 04:33:02.364529 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-9077 |
vulnerable | 2026-09-16 04:33:02.018689 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-9205 |
vulnerable | 2026-09-16 04:33:01.980870 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-9201 |
vulnerable | 2026-09-16 04:33:01.911787 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-8470 |
vulnerable | 2026-09-16 04:32:58.340540 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-8182 |
vulnerable | 2026-09-16 04:32:58.274504 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-8478 |
vulnerable | 2026-09-16 04:32:58.174796 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-8183 |
vulnerable | 2026-09-16 04:32:58.135541 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-8446 |
vulnerable | 2026-09-16 04:32:57.590243 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-10128 |
vulnerable | 2026-09-16 04:32:43.233077 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-10547 |
vulnerable | 2026-09-16 04:32:43.098745 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.