Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
IBM Langflow OSS (an open-source tool for building AI applications) versions 1.0.0 through 1.10.3 has a vulnerability where an authenticated attacker can execute unintended code because the application runs Python code generated by the AI model during validation before a user approves it. This allows attackers to perform harmful actions like accessing the network, interacting with files, or stealing data using the permissions of the Langflow backend process.
IBM Langflow OSS (an open-source tool for building AI applications) versions 1.0.0 through 1.10.3 have an authorization bypass vulnerability in the MemoryComponent, which stores conversation data. Authenticated users can view other users' chat histories by exploiting session_id collision (when different users accidentally get the same session identifier), because the system doesn't properly verify that a user owns the data they're requesting. This only affects systems with multiple users where automatic login is disabled.
IBM Langflow OSS (an open-source software framework for building AI applications) versions 1.0.0 through 1.10.3 has a code injection vulnerability (CWE-94, where attackers can insert malicious code by exploiting improper input validation) that allows remote attackers to execute arbitrary code on affected systems.
IBM Langflow OSS versions 1.0.0 through 1.10.3 use Python's non-cryptographic random module (a weak randomness generator not designed for security) to create Fernet encryption keys (a cryptographic method for protecting data) from user secrets under 32 characters. Because the Mersenne Twister PRNG (pseudorandom number generator, an algorithm that produces predictable sequences) produces identical keys from identical seeds, attackers can recreate these keys and decrypt stored API keys and authentication tokens.
IBM Langflow OSS versions 1.0.0 through 1.10.3 contain a path traversal vulnerability (CWE-22, a weakness where an attacker can access files outside the intended directory) that allows remote attackers to view arbitrary files on a system by sending specially crafted URLs with dot-dot sequences (/../) to bypass directory restrictions.
CVE-2026-8182 is a critical vulnerability in IBM Langflow OSS (open-source software) versions 1.0.0 through 1.10.3 that allows anyone on the internet to execute arbitrary code (run any commands they want) on the affected server without needing a password or login, using just 2 HTTP requests (standard web communications). This is a code injection vulnerability, where attackers can insert malicious code into the system.
IBM Langflow OSS versions 1.0.0 through 1.10.3 has a path traversal vulnerability (a flaw where an attacker can access files outside their intended directory) in the Knowledge Bases API endpoint. An authenticated attacker can exploit this by sending specially crafted knowledge base names that aren't properly checked, allowing them to create directories and write files anywhere on the server.
IBM Langflow OSS (open-source software) versions 1.0.0 through 1.10.3 has a vulnerability where the username field is not properly checked, allowing attackers to use path traversal (a technique to access files outside intended directories by using sequences like '../'). This flaw could let attackers delete files from any directory, destroy data belonging to other users, or remove JWT signing keys (cryptographic keys used to verify user sessions), which would invalidate all user sessions.
PraisonAI (a system for running multiple AI agents together as teams) versions before 4.6.40 have a command injection vulnerability (a flaw where attackers can sneak malicious commands into the system) in its GitHub Actions workflow (an automation tool for running code when repository changes happen). An outside contributor can create a pull request with a malicious branch name and trigger the vulnerable workflow with a comment, allowing them to run harmful commands with powerful permissions like writing to the repository and accessing authentication tokens.
IBM Langflow OSS (an open-source AI tool framework) versions 1.0.0 through 1.10.3 has a vulnerability that allows an authenticated attacker (someone with login access) to run arbitrary code (any commands they choose) on the system through code injection (inserting malicious code into the application's input). The vulnerability has a CVSS score (severity rating on a 0-10 scale) that has not yet been assigned by NIST.
IBM Langflow OSS (an open-source tool for building AI applications) versions 1.0.0 through 1.10.3 has a vulnerability where a logged-in attacker could run malicious code on the system because the software doesn't properly check Python code during AST-based security scanning (a method that analyzes code structure before execution). This is a code injection vulnerability (CWE-94), meaning attackers can insert and execute their own code.
IBM Langflow OSS versions 1.0.0 through 1.10.3 contain a vulnerability that allows a remote authenticated attacker (someone with login access) to run arbitrary code (any commands they choose) due to improper validation of module imports (not properly checking which code libraries are being loaded). The vulnerability is classified as CWE-94, a type of code injection (inserting malicious code into a program).
IBM Langflow OSS (an open-source workflow tool) versions 1.0.0 through 1.10.3 has a vulnerability where an authenticated user can inject malicious graph data into a shared cache by exploiting improper ownership validation in a deprecated API endpoint. This could allow attackers to corrupt data for other users, run workflows without permission, or crash the system.
IBM Langflow OSS versions 1.0.0 through 1.10.3 contain a server-side request forgery (SSRF, a vulnerability where an attacker tricks a server into making unwanted requests to other systems) in the validate_model_provider_key() function for the Ollama provider. The vulnerability exists because the function accepts a user-supplied URL parameter without checking if it's safe, allowing attackers to potentially access private internal networks or services.
IBM Langflow OSS versions 1.0.0 through 1.10.3 contain a vulnerability that allows server-side request forgery (SSRF, where an attacker tricks a server into making unwanted requests to internal systems) because the software's protections against this attack are incomplete and not properly enforced. The vulnerability has a CVSS score that is still being assessed by the National Institute of Standards and Technology.
IBM Langflow OSS versions 1.0.0 through 1.10.3 contain a vulnerability that allows a remote authenticated attacker (someone who has logged in to the system) to execute arbitrary commands due to improper neutralization of special elements used in OS commands (a weakness called OS command injection, where attackers can sneak malicious commands into system operations). The vulnerability affects multiple versions of this open-source AI/LLM workflow tool.
IBM Langflow OSS (an open-source framework for building AI applications) versions 1.0.0 through 1.10.3 has a vulnerability where authenticated users (people already logged in) can exploit a built-in component to read arbitrary server environment variables (configuration settings stored on the server), potentially exposing sensitive secrets even when security controls are meant to prevent this. This is classified as CWE-200 (exposure of sensitive information to an unauthorized actor).
CVE-2026-9077 is a vulnerability in IBM Langflow OSS versions 1.0.0 through 1.10.3 that allows authenticated attackers (users with login credentials) to bypass localhost-only restrictions, which are security limits meant to prevent remote access. Attackers can exploit this to write arbitrary MCP server configurations (settings for external server connections) to IDE configuration files on the host system. The vulnerability stems from reliance on untrusted inputs in security decisions without proper validation.
IBM Langflow OSS versions 1.0.0 through 1.10.3 have an authentication bypass vulnerability in the Model Context Protocol (MCP, a system for connecting AI models to external tools) composer endpoint when certain settings are enabled. This means attackers could potentially access protected features without proper login credentials when mcp_composer_enabled is set to true and projects use oauth (a login method) for authentication.
IBM Langflow OSS (open-source software) versions 1.0.0 through 1.10.3 has a path traversal vulnerability (a flaw where attackers can access files outside the intended directory by using special sequences like '../' in filenames). Attackers can exploit this by sending specially crafted MCP (model context protocol) requests to read sensitive files from the server, including other users' documents, authentication secrets (JWT signing keys), databases, and system environment variables.
Fix: Update to version 4.6.40 or later, where this issue has been fixed.
NVD/CVE Database