IBM X-Force has disclosed two vulnerabilities in Langflow OSS, including a critical flaw rated 9.6 on the CVSS v3 scale. CVE-2026-12944 affects versions 1.0.0 through 1.10.0 and is caused by an incomplete security scanner blocklist. Although dangerous modules such as `subprocess` are blocked, `socket` and `urllib` are not. Authenticated users can therefore submit components containing calls such as `socket.connect()` or `urllib.request.urlopen()` at module level, which run on the server during component validation.
According to the report, malicious code runs with root privileges inside the container and could create reverse shells, read local files, connect to external systems or expose cloud credentials. The issue could also allow attackers to move towards internal services, including PostgreSQL and Redis. A second issue, CVE-2026-17628, is rated 5.4 and affects versions 1.0.0 through 1.10.2.
Its password-reset endpoint accepts a new password without checking the existing credential, meaning an attacker with a hijacked session could lock legitimate users out. No active exploitation of either vulnerability has been observed.
IBM advises administrators of self-hosted deployments to upgrade to Langflow OSS 1.10.3, which fixes both defects.