AI Sec Watch

IBM Langflow OSS (open-source software) versions 1.0.0 through 1.10.1 contain hard-coded credentials (passwords or encryption keys built directly into the code), which the software uses for its own authentication, communication with external systems, and data encryption. This vulnerability allows attackers to potentially gain unauthorized access or compromise the security of systems using these versions.

IBM Langflow OSS (open-source software) versions 1.0.0 through 1.10.1 has a vulnerability where a logged-in attacker can misuse the SaveToFile component (a tool that saves data to files) to access and change files belonging to other users by using absolute paths (complete file addresses). The attacker can either read and copy other users' files to their own account (confidentiality breach, where private information is exposed) or overwrite those files with fake data (integrity breach, where data is corrupted or replaced).

IBM Langflow OSS versions 1.0.0 through 1.10.0 has a path traversal vulnerability (a flaw where an attacker can escape the intended directory using sequences like ../ to access other folders) in the "Save to File" feature. An attacker controlling an external server can trick the system into writing files to unintended locations by sending crafted filenames in HTTP response headers, potentially allowing them to overwrite or create files anywhere the Langflow application can access.

IBM Langflow OSS (open-source software) versions 1.0.0 through 1.10.0 has a vulnerability where authenticated users (those with login access) can escalate privileges to superuser (gain the highest level of system access) by directly manipulating the database, potentially executing arbitrary system commands (running any code they want) and compromising the entire system. This is caused by improper control of code generation (code injection, where attackers inject malicious code into the system).

IBM Langflow OSS versions 1.0.0 through 1.10.0 have a vulnerability where webhook authentication can be bypassed when a configuration setting is disabled (which is the default), allowing attackers who know a flow's identifier to execute it and potentially run arbitrary code (RCE, or remote code execution). The system incorrectly skips checking API keys (credentials that verify a user's identity) when the WEBHOOK_AUTH_ENABLE setting is turned off.

IBM Langflow OSS versions 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability (RCE, where attackers can run commands on a system they don't own) in the code validation API endpoint. The vulnerable endpoint accepts and directly executes user-supplied Python code without any sandboxing (isolation from the rest of the system) or input validation, allowing authenticated users to run arbitrary system commands with full server privileges.

IBM Langflow OSS versions 1.0.0 through 1.10.0 have a critical vulnerability in their caching system that allows attackers to run arbitrary code on the server. The problem occurs because the software uses an unsafe deserialization method (pickle.loads(), which converts stored data back into Python objects without checking if it's trustworthy) to load cached data from disk, and attackers can exploit this by inserting malicious data through file access, workflow inputs, or API calls.

IBM Langflow OSS (open-source software) versions 1.0.0 through 1.10.0 contains a critical security flaw in the `apply_tweaks()` function that allows authenticated users (those with login credentials) to override component parameters at runtime via the API (application programming interface, which lets software communicate with other software). This is a type of code injection vulnerability (where attackers insert malicious code by manipulating input that the system then executes).

CVE-2026-7872 is a vulnerability in IBM Langflow OSS (open-source software) versions 1.0.0 through 1.10.0 that allows an authenticated attacker (someone with login credentials) to read arbitrary files on the system, including the JWT signing key (a secret used to create authentication tokens). With access to this key, an attacker could forge authentication tokens to impersonate any user.