Description

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to execute arbitrary code due to an authorization bypass in the flow build process.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-04T16:17:21.900Z",
  "pubdate": "2026-09-04T16:17:21.900Z",
  "executiveSummary": "This vulnerability is an authorization bypass leading to Remote Code Execution (RCE) in IBM Langflow OSS versions 1.0.0 through 1.11.2.\nThe flaw resides within the flow build process, where inadequate validation of user permissions allows a remote authenticated attacker to execute arbitrary commands on the underlying host system.\nThe vulnerability represents a critical security risk, as it enables an authenticated user to escalate privileges beyond their intended scope to gain full control over the application server.\nSuccessful exploitation requires the attacker to have legitimate access to the application, but it does not require administrative privileges, significantly increasing the attack surface.\nThe impact includes full system compromise, potential data exfiltration, and unauthorized manipulation of integrated backend services.\nUsers are strongly advised to restrict access to the application interface and monitor for suspicious build requests while awaiting specific remediation steps from IBM.",
  "technicalDetails": "The vulnerability manifests within the core flow orchestration component of IBM Langflow OSS, specifically during the graph definition and build execution phase.\nThe root cause is an authorization bypass in the backend logic responsible for processing flow construction requests. Although the application authenticates the initial session, the build process fails to perform secondary validation of the caller's authorization to initiate sensitive execution tasks.\nWhen a user submits a crafted flow definition via the build endpoint, the application incorrectly trusts the input parameters. By injecting malicious components or manipulating the build instructions within the flow configuration, an attacker can coerce the server to execute arbitrary code with the same privileges as the IBM Langflow service process.\nThe attack flow proceeds as follows: First, an authenticated attacker crafts a payload representing a valid flow graph containing malicious nodes or configurations designed to trigger command execution on the host operating system. Second, the attacker transmits this configuration to the vulnerable flow build API endpoint.\nBecause the system lacks sufficient server-side verification of these parameters, the build engine processes the malicious instructions. This results in the execution of the injected code contextually during the 'build' operation, bypassing intended execution sandboxes or restrictive controls.\nThe vulnerability is present in versions 1.0.0 through 1.11.2. The exploitation is facilitated by the application's design to execute dynamic components, which is a feature inherent to Langflow's workflow automation capabilities. However, in this specific instance, the lack of strict access control checks on these features turns an intended feature into an RCE vector.\nPost-exploitation impact is severe, as the attacker achieves execution within the environment of the IBM Langflow service. If the service is running with elevated permissions, the attacker can move laterally within the network, access connected databases, steal configuration secrets, or establish persistent backdoors on the server.\nBecause the flow build process is a high-frequency activity, automated exploitation scripts could be developed to reliably trigger the RCE once the attacker has successfully authenticated into the platform, regardless of their legitimate role permissions."
}