Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-19295 (primary), CVE-2026-19286 |
| Alert Source | GitHub Advisory - Critical vulnerability |
| CVE Year | 2026 |
| Publication Date | 2026-08-29 |
| Vendor | IBM |
| Product | Langflow OSS 1.0.0 – 1.11.1 |
| CVSS Score | 9.9 (CVE-2026-19295), 9.8 (CVE-2026-19286) |
| EPSS Score | No data |
| CISA KEV | No |
| Ransomware | Not confirmed |
This alert covers two vulnerabilities in the same product, disclosed together. Both lead to code execution on the Langflow server and both are removed by the same update.
Vulnerability Description
Source: NVD / IBM PSIRT
CVE-2026-19295 (CVSS 9.9) — command execution via a crafted flow
IBM Langflow OSS versions 1.0.0 through 1.11.1 allow an authenticated attacker to execute arbitrary operating system commands in the server process. The attack works by saving a flow with a crafted type field value and then triggering a build of a wrapper flow that references it.
IBM describes the impact as privilege escalation “from authenticated user” — meaning an ordinary account in the tool is enough to take over the server it runs on.
CVE-2026-19286 (CVSS 9.8) — RCE through the public A2A endpoint
The same version branch contains a second flaw: improper enforcement of security restrictions on the public A2A endpoint allows a remote attacker to execute arbitrary code. Unlike the first, this one requires no authentication.
Required Actions
- Upgrade Langflow OSS beyond 1.11.1, per IBM’s advisory.
- Until then, cut off network access to Langflow instances from outside a trusted segment — particularly to the A2A endpoint.
- Verify which account and container the Langflow process runs under. Code execution happens with its privileges, so process isolation directly limits the impact.
- Check whether the instance is exposed to the internet. AI flow-building tools tend to be spun up “quickly” for testing and stay reachable longer than intended.
Who Is Affected?
The vulnerabilities affect IBM Langflow OSS installations in versions 1.0.0 – 1.11.1.
Langflow is a tool for visually building flows around language models. It shows up where teams — often outside the formal IT process — prototype AI use cases: customer service chatbots, document processing, internal assistants.
That creates a characteristic risk. AI tools deployed as pilots rarely pass through asset inventory and the vulnerability management cycle, yet they have access to the data they process in those prototypes — frequently production data. If anyone in your organisation is experimenting with Langflow, this is the moment to find out where, and with what privileges.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
