Disclosed vulnerability
IBM Langflow OSS: coordinated September 2026 disclosure of multiple code-execution and control-bypass flaws (fixed 1.11.6)
AIR-2026-0226 AIR record · 2026-09-ibm-langflow-oss-code-execution-cluster
From the supporting source
constructing a flow with an MCP Tools component configured to use a local stdio subprocess transportibm.com
The record
Disclosed
2026-09-08
Vendor
IBM / Langflow OSS
Product
Langflow OSS
Risk domain
Access control and permissions › Credential theft
Also touches
Privilege escalation, Data exfiltration channels
System type
Generative model
Who acted
AI was the target — agent framework code-execution flaws; no model decision
Attack surface
Agent framework
Autonomy level
Assistant
Initial vector
Crafted flow or component
Impact type
Remote code execution, Credential theft, Server side request forgery, Data exfiltration
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0012 – Valid Accounts
- NIST AI RMF
- MEASURE 2.7
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool failure
- Mitigation
- Use secure credential storage; Implement short-lived tokens.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Langflow OSS 1.0.0 through 1.11.5 (one flaw 1.0.0-1.10.0)
Capability abused
Defense & remediation
Recorded defense
LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY / LANGFLOW_BLOCK_CODE_INTERPRETER_COMPONENTS and a static security scanner
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
Langflow OSS 1.11.6 (CVE-2026-12944 fixed in 1.10.1)
Taxonomy & references
Curator notes
UMBRELLA record for IBM's September 2026 Langflow OSS security bulletins (node/7286666 published 2026-09-08 bundles 11 CVEs fixed in 1.11.6; node/7278919 covers CVE-2026-12944 fixed in 1.10.1, bulletin modified 2026-09-14). Fused per the corpus umbrella precedent; many overlap the same root causes (incomplete denylists in the security scanner, unwired execution guards, MCP-tools stdio subprocess, code injection during graph construction). Several reach root (UID=0) with IMDSv1 SSRF for AWS credential theft and lateral movement. All authenticated or unauthenticated PoC-level disclosures; no real victim. Distinct from older corpus Langflow CVEs (CVE-2025-3248, CVE-2026-48519).
Supporting sources
Cite as
Enkrypt AI. "IBM Langflow OSS: coordinated September 2026 disclosure of multiple code-execution and control-bypass flaws (fixed 1.11.6)". AIR, AIR-2026-0226. https://agentincident.vercel.app/i/AIR-2026-0226/ (accessed 2026-10-19).