CSIRTS // UNIFIED SECURITY ADVISORY FEEDSYS ● ONLINE · POWERED BY INTELFUSIONS.COM

← Back to feed

CVE-2026-18904

highcovered by 1 sourcefirst seen 2026-08-24
An attacker can exploit multiple vulnerabilities in Langflow OSS to bypass security measures, disclose confidential information, and manipulate data.

CSIRTS triage

vendor: Langflowproduct: Langflow OSSAuthentication bypassInformation disclosureCode injection
What
Multiple vulnerabilities enable security bypass, confidential information disclosure, and data manipulation.
Who is affected
Deployments of Langflow OSS exposed to network or authenticated attackers.
Urgency
High priority; multiple high-severity vulnerabilities affecting security and data integrity require prompt patching.
Action
Apply patches for Langflow OSS addressing CVE-2026-18891, CVE-2026-18899, CVE-2026-18904, CVE-2026-18545, and CVE-2026-19294.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch CVE-2026-18904

Get an email if CVE-2026-18904 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Advisory coverage (1)

External references

NVD record for CVE-2026-18904

CVE.org record

Embed the live status

CVE-2026-18904 live status badge — this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-18904 status](https://www.csirts.com/badge/CVE-2026-18904)](https://www.csirts.com/cve/CVE-2026-18904)