Critical Langflow Flaw Lets Authenticated Users Run Code as Root

IBM X-Force has disclosed two vulnerabilities in Langflow OSS, including a critical flaw rated CVSS 9.6. CVE-2026-12944 affects versions 1.0.0 through 1.10.0 and results from an incomplete security-scanner blocklist. Although dangerous Python modules such as `subprocess` are blocked, the scanner reportedly fails to prevent use of the standard `socket` and `urllib` libraries.

Authenticated users can therefore submit components containing calls such as `socket.connect()` or `urllib.request.urlopen()` at module level, causing code to run on the server during component validation.

The article says malicious code could connect to external systems, create reverse shells or steal local files, with execution taking place as root inside the container. The flaw could also allow access to cloud credentials and connections to internal services, although no exploitation has been confirmed. A second issue, CVE-2026-17628, is rated CVSS 5.4 and affects versions 1.0.0 through 1.10.2.

It involves missing password verification in the password-reset endpoint: an attacker who has hijacked a session could set a new password and lock out the legitimate user.

IBM advises administrators to upgrade immediately to Langflow OSS 1.10.3, which fixes both vulnerabilities.