[NEW] [high] Langflow OSS: Multiple vulnerabilities
An attacker can exploit multiple vulnerabilities in Langflow OSS to bypass security measures, disclose confidential information, and manipulate data.
CSIRTS triage
- What
- Multiple vulnerabilities enable security bypass, confidential information disclosure, and data manipulation.
- Who is affected
- Deployments of Langflow OSS exposed to network or authenticated attackers.
- Urgency
- High priority; multiple high-severity vulnerabilities affecting security and data integrity require prompt patching.
- Action
- Apply patches for Langflow OSS addressing CVE-2026-18891, CVE-2026-18899, CVE-2026-18904, CVE-2026-18545, and CVE-2026-19294.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Langflow OSS
Get an email when a new Langflow OSS advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2965
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-18891 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-18899 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-18904 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-18545 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-19294 | coverage & exploitation status | NVD · CVE.org |
Recent advisories for Langflow OSS
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- high[NEW] [high] Langflow OSS: Multiple Vulnerabilitiescert-bund · 2026-08-25
- highCVE-2026-19875: IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to overwrite administrator…nvd · 2026-08-19
- criticalCVE-2026-19297: IBM Langflow OSS 1.0.0 through 1.9.6 could allow a remote attacker to obtain unauthorized acce…nvd · 2026-08-13
- highCVE-2026-9205: IBM Langflow OSS contains a weak cryptographic key derivation vulnerability in the ensure_ferne…nvd · 2026-08-05
- highCVE-2026-9201: IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute arbitrar…nvd · 2026-08-05
- highCVE-2026-9196: IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute unintend…nvd · 2026-08-05
More from CERT-Bund (BSI) Security Advisories
- high[NEW] [high] Linux Kernel: Multiple vulnerabilities2026-08-25
- medium[NEW] [medium] libTIFF: Multiple Vulnerabilities2026-08-25
- high[NEW] [high] Contao: Multiple Vulnerabilities2026-08-25
- medium[NEW] [medium] Django: Multiple Vulnerabilities2026-08-25
- high[NEW] [high] Red Hat Enterprise Linux (Apicurio Registry): Multiple Vulnerabilities2026-08-25