SB2026080520 - Multiple vulnerabilities in Langflow
Published: August 5, 2026 Updated: October 16, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 vulnerabilities.
1) Code Injection (CVE-ID: CVE-2026-7700)
CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to the prompt injection issue in the Smart Transform component. A remote user can execute arbitrary code on the target system.
2) Authentication Bypass by Spoofing (CVE-ID: CVE-2026-105741)
CWE-ID: CWE-290 - Authentication Bypass by Spoofing
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to overwrite MCP client configuration files on the server and bypass a local-only access restriction.
The vulnerability exists due to authentication bypass by spoofing in the MCP configuration installation endpoint (`POST /api/v1/mcp/project/{project_id}/install`) and `get_client_ip` helper when handling requests with a spoofed `X-Forwarded-For` header. A remote user can send a specially crafted request with `X-Forwarded-For: 127.0.0.1` to overwrite MCP client configuration files on the server and bypass a local-only access restriction.
The write target is limited to a fixed set of per-OS developer tool configuration files resolved by the application rather than an attacker-supplied arbitrary path.
3) Server-Side Request Forgery (SSRF) (CVE-ID: N/A)
CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:L/SI:N/SA:N]
The vulnerability allows a remote user to access internal services and cloud metadata endpoints from the Langflow server, disclose sensitive information such as credentials or tokens, and interact with services on private networks.
The vulnerability exists due to missing or non-enforcing server-side request forgery protection in Langflow's API Request, RSS Reader, SearXNG, Web Search, Home Assistant, Glean Search, and Docling Serve components when processing user-controlled URLs. A remote user can build or run flows that direct these components to addresses such as http://169.254.169.254/latest/meta-data/ or http://10.0.0.1/ to reach internal services and, in many cases, retrieve their responses through component output.
Remediation
Install update from vendor's website.