SB2026080727 - Multiple vulnerabilities in Langflow

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026080727

SB2026080727 - Multiple vulnerabilities in Langflow

Published: August 7, 2026 Updated: October 16, 2026

Security Bulletin ID SB2026080727
CSH Severity
Critical
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Critical 25% High 25% Medium 25% Low 25%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 vulnerabilities.


1) Code Injection (CVE-ID: CVE-2026-9198) Exploited

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to improper control of code generation in the /api/v1/validate/code endpoint when handling code submitted after obtaining a bearer token from /api/v1/auto_login. A remote attacker can obtain a superuser bearer token and submit malicious Python code to execute arbitrary code.

This affects default-configured instances where the auto-login feature is enabled and the validation endpoint is network-accessible.


2) Code Injection (CVE-ID: N/A)

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper control of code generation in the validate_code function exposed through the /api/v1/validate/code endpoint when processing user-supplied Python function definitions with malicious decorators. A remote user can send a specially crafted POST request containing a malicious decorator to execute arbitrary code.

Instances configured with AUTO_LOGIN can be exposed to any user without a valid session.


3) Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) (CVE-ID: N/A)

CWE-ID: CWE-338 - Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information and compromise the integrity of stored credentials.

The vulnerability exists due to weak prng-based cryptographic key derivation in the Fernet key derivation logic in src/backend/base/langflow/services/auth/service.py and src/backend/base/langflow/services/auth/utils.py when deriving the encryption key from the SECRET_KEY. A remote attacker can obtain the SECRET_KEY and encrypted credential data to decrypt stored credentials offline to disclose sensitive information and compromise the integrity of stored credentials.

All credential-type variables are encrypted under a shared instance-wide key, so a single exposed secret can affect credentials stored by all users on the instance.


4) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-105698)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose private flow structure and vertex outputs and trigger unauthorized execution of another user's flow vertices.

The vulnerability exists due to missing flow ownership checks in the deprecated Langflow chat API endpoints POST /api/v1/build/{flow_id}/vertices and POST /api/v1/build/{flow_id}/vertices/{vertex_id} when handling requests with user-controlled flow identifiers. A remote user can submit direct HTTP requests containing a known target flow UUID to enumerate its vertices and execute individual vertices, retrieving their outputs and triggering configured side effects.

Global variables and credentials in the variable store are not exposed because variable resolution uses the caller's user ID.


Remediation

Install update from vendor's website.

References