CVE-2026-12944: Incomplete Security Scanner Blocklist Enables Network-Based Code Execution
IBM Langflow OSS 1.0.0 through 1.10.0 can allow attackers to execute arbitrary Python code with root privileges (UID=0) on the Langflow server by submitting components containing socket or urllib imports. This enables: (1) AWS credential theft via IMDSv1 SSRF with full IAM role permissions, (2) arbitrary file exfiltration from the container filesystem, and (3) lateral movement to internal services (PostgreSQL, Redis) within the Docker network. The scanner incorrectly returns "validated": true, providing a false security signal.
Other sources
Langflow OSS can allow attackers to execute arbitrary Python code with root privileges (UID=0) on the Langflow server by submitting components containing socket or urllib imports. This enables: (1) AWS credential theft via IMDSv1 SSRF with full IAM role permissions, (2) arbitrary file exfiltration from the container filesystem, and (3) lateral movement to internal services (PostgreSQL, Redis) within the Docker network. The scanner incorrectly returns "validated": true, providing a false security signal.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Langflow OSSto a version that resolves this vulnerability.Fixed in 1.10.1 - Compensating control
Because the scanner can incorrectly return "validated": true, do not rely on the incomplete security scanner blocklist signal; instead, treat components containing socket or urllib imports as untrusted and restrict/inspect component submission to prevent network-based code execution.
Event History
Frequently Asked Questions
Which deployments are affected?
IBM Langflow OSS versions 1.0.0 through 1.10.0 are affected. The vulnerable behavior occurs when submitted components contain socket or urllib imports.
What level of access does an attacker need?
The supplied data indicates network-based exploitation with low attack complexity and low privileges required, with no user interaction required. Exploitation involves submitting a malicious component to the Langflow server.
What can an attacker access after exploitation?
Attackers can execute arbitrary Python code as root (UID 0) on the Langflow server. They may steal AWS credentials through IMDSv1 SSRF, exfiltrate container filesystem files, and move laterally to internal PostgreSQL or Redis services on the Docker network.
Can the scanner's validation result be trusted?
No. The scanner can return "validated": true for components containing socket or urllib imports even though those imports can be used to achieve code execution and SSRF.