IBM Langflow OSS Flaw Lets Authenticated Users Escalate to Full RCE

Executive Summary

A second critical vulnerability disclosed alongside CVE-2026-19286, CVE-2026-19295 affects IBM Langflow OSS 1.0.0 through 1.11.1 and carries a CVSS score of 9.9. It allows an authenticated attacker to execute arbitrary operating system commands in the Langflow server process by saving a flow with a crafted type field value and then triggering a build of a wrapper flow that references it.

CVSS Score: 9.9 (Critical)

Critically, this flaw bypasses the LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false policy control — the setting administrators use specifically to prevent low-privileged flow users from running arbitrary code. Any organization relying on that flag as a security boundary for multi-tenant or shared Langflow deployments should treat this as an active compromise path, not a theoretical one.

Vulnerability Overview

Affected Versions

Technical Details

The flaw lives in how Langflow validates flow definitions before building them. An attacker who holds any authenticated "flow user" account can:

1. Save a flow containing a maliciously crafted value in its type field
2. Create a second "wrapper flow" that references the malicious flow
3. Trigger a build of the wrapper flow

When the wrapper flow is built, the crafted type field is processed in a way that causes the server to execute arbitrary operating system commands under the identity of the Langflow server process — not the low-privileged flow user. This effectively escalates a standard user account into full command execution on the host, regardless of whether administrators have set LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false to lock down custom code execution.

Because exploitation requires only a valid low-privilege account and no user interaction from an administrator, self-service or multi-tenant Langflow deployments — where any user can sign up or has standard flow-builder access — are especially exposed.

Attack Vector

1. Attacker authenticates to a Langflow OSS instance (1.0.0-1.11.1) with a standard account
2. Attacker saves a flow with a crafted 'type' field value
3. Attacker creates a wrapper flow that references the crafted flow
4. Attacker triggers a build of the wrapper flow
5. Langflow server executes the embedded command under the server process identity
6. Attacker gains OS-level command execution, bypassing custom-component restrictions

Impact of Successful Exploitation

Immediate Remediation

Step 1: Patch Langflow

pip install --upgrade langflow
langflow --version

Confirm the reported version falls outside the 1.0.0-1.11.1 affected range once IBM/the Langflow project ships a fix for this CVE.

Step 2: Tighten Access Until Patched

1. Restrict who can register or hold flow-builder accounts on shared instances
2. Do not rely solely on LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false as a security boundary until patched
3. Review and revoke unused or low-trust user accounts

Step 3: Audit Existing Flows

# Review saved flows for unusual or unrecognized 'type' field values
# (inspect via the Langflow admin UI or the underlying flow store)
 
# Check server logs for build events tied to unfamiliar wrapper flows
grep -i "build" /path/to/langflow/logs/*.log

If Immediate Patching Is Not Possible

1. Limit flow-builder accounts to trusted, known users only
2. Disable self-service account creation on the instance
3. Monitor build events for anomalous flow references
4. Isolate the Langflow host from sensitive internal networks and secrets stores

Detection Indicators

Post-Remediation Steps

1. Confirm the Langflow version is patched and out of the 1.0.0-1.11.1 range
2. Audit all user accounts with flow-builder access and remove unnecessary ones
3. Review all existing flows for malicious type field values or unauthorized wrapper flows
4. Rotate all credentials accessible from the Langflow host
5. Reassess reliance on LANGFLOW_ALLOW_CUSTOM_COMPONENTS as a sole security control
6. Track IBM's security bulletins for the confirmed fixed Langflow OSS version

References

• NVD — CVE-2026-19295
• Endor Labs — CVE-2026-55255: Langflow IDOR Vulnerability Allows Authenticated Attackers to Execute Arbitrary User Flows
• Endor Labs — CVE-2026-33017, Unauthenticated RCE in Langflow via Public Flow Build Endpoint

Related Reading

• Critical RCE in IBM Langflow OSS via Unauthenticated A2A Endpoint
• Langflow CVE-2026-33017: RCE Exploited Within 20 Hours