CSIRTS // UNIFIED SECURITY ADVISORY FEEDSYS ● ONLINE · POWERED BY INTELFUSIONS.COM

← Back to feed

[NEW] [high] Langflow OSS: Multiple Vulnerabilities

highCVE-2026-18729CVE-2026-19286CVE-2026-19295
An attacker can exploit multiple vulnerabilities in Langflow OSS to execute arbitrary code and execute arbitrary code with administrator privileges.

CSIRTS triage

vendor: Langflowproduct: Langflow OSSRemote code executionPrivilege escalation
What
Multiple vulnerabilities enable arbitrary code execution and privilege escalation to administrator level.
Who is affected
All deployments of Langflow OSS are affected, with direct remote access or authenticated paths depending on vulnerability.
Urgency
High severity due to unauthenticated or low-privilege code execution and administrator escalation; immediate patching required.
Action
Upgrade Langflow OSS to a patched version addressing CVE-2026-18729, CVE-2026-19286, and CVE-2026-19295.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch Langflow OSS

Get an email when a new Langflow OSS advisory drops — max one per day, one-click unsubscribe.

Details

Source
CERT-Bund (BSI) Security Advisories (DE · national-cert · site)
Severity
high
Published
2026-08-25
Exploitation
Not in CISA KEV at last sync
Language
Machine-translated to English — verify against the original

Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2995

Referenced CVEs

CVECSIRTS overviewExternal
CVE-2026-18729coverage & exploitation statusNVD · CVE.org
CVE-2026-19286coverage & exploitation statusNVD · CVE.org
CVE-2026-19295coverage & exploitation statusNVD · CVE.org

Recent advisories for Langflow OSS

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

More from CERT-Bund (BSI) Security Advisories