DeutschShown in its original language — a full translation is planned for a future version.
IBM Langflow Desktop: Mehrere Schwachstellen
view advisory published 2026-07-14
Ein Angreifer kann mehrere Schwachstellen in IBM Langflow Desktop ausnutzen, um beliebigen Programmcode auszuführen, um Sicherheitsvorkehrungen zu umgehen, und um Informationen offenzulegen.
01
describes (10)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-13444US | — | — | ||
IBM Langflow OSS 1.0.0 through 1.10.1 can allow an attacker to access another user's private vector documents by creating their own flow with matching Chroma persist_directory and… | ||||
| CVE-2026-13435US | — | — | ||
IBM Langflow OSS 1.0.0 through 1.10.1 contains an improper input validation vulnerability in the PythonREPL sandbox implementation. | ||||
| CVE-2026-12942US | high7.5 | — | ||
IBM Langflow OSS 1.0.0 through 1.10.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot do… | ||||
| CVE-2026-12945US | — | — | ||
IBM Langflow OSS 1.0.0 through 1.10.1 allows authenticated users to access and manipulate other users' build jobs through improper access control on log retrieval and unauthenticat… | ||||
| CVE-2026-12940US | — | Exploit | ||
IBM Langflow OSS 1.0.0 through 1.10.1 are vulnerable to unauthenticated remote code execution via environment variable injection in the MCP (Model Context Protocol) stdio launcher… | ||||
| CVE-2026-13442US | — | — | ||
IBM Langflow OSS 1.0.0 through 1.10.1 can allow an attacker to reuse another user's FAISS namespace to access owner-only vector content and influence later query results. This caus… | ||||
| CVE-2026-13446US | —OT elevated | — | ||
IBM Langflow OSS 1.0.0 through 1.10.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communica… | ||||
| CVE-2026-13445US | — | — | ||
IBM Langflow OSS 1.0.0 through 1.10.1 can allow an authenticated attacker to exploit the SaveToFile component to read and modify another user's uploaded files by specifying absolut… | ||||
| CVE-2026-14499US | — | — | ||
IBM Langflow OSS 1.0.0 through 1.10.1 Langflow could allow an authenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of… | ||||
| CVE-2026-13448US | critical9.8 | — | ||
IBM Langflow OSS 1.0.0 through 1.10.1 Lanflow OSS contains an unauthenticated remote code execution vulnerability in the public flow build endpoint ( /api/v1/build_public_tmp/{flow… | ||||
02
references
External citations — patches, advisories, analysis.
- WID-SEC-W-2026-2366 - CSAF Versionself
- WID-SEC-2026-2366 - Portal Versionself
- IBM Security Bulletin 7279987 vom 2026-07-14external
- IBM Security Bulletin 7279988 vom 2026-07-14external
- IBM Security Bulletin 7279989 vom 2026-07-14external
- IBM Security Bulletin 7279990 vom 2026-07-14external
- IBM Security Bulletin 7279991 vom 2026-07-14external
- IBM Security Bulletin 7279993 vom 2026-07-14external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan