Where
AND
-Infinity
0

Trending

Last week
Last month
Last year

IBM Langflow DesktopAuthenticated Remote Code Execution Vulnerability in Langflow Code Validation Endpoint

Risk 56
Severity
8.8
EPSS
0.04%
Code Injection
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

IBM Langflow Desktop 1.0.0 through 1.8.4 Langflow allows an attacker to execute arbitrary commands with the privileges of the process running Langflow. This allows reading sensitive environment variables (API keys, DB credentials), modifying files, or launching further attacks on the internal network.

1 / 2
Source: MITRE
First published (updated )
CVE-2026-6543

IBM Langflow DesktopIBM Langflow Desktop 1.0.0 - 1.9.2 DNS Rebinding Bypasses SSRF Protection Allowing Access to Internal Services

Risk 34
Severity
5.4
SSRF
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

IBM Langflow Desktop 1.0.0 through 1.9.2 IBM Langflow is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

1 / 2
Source: MITRE
First published (updated )
CVE-2026-3341

IBM Langflow DesktopUnauthenticated Insecure Direct Object Reference (IDOR) Vulnerability in Langflow Desktop Image Download Endpoint

Risk 43
Severity
7.5
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

IBM Langflow Desktop 1.0.0 through 1.8.4 Langflow could allow an unauthenticated user to view other users' images due to an indirect object reference through a user-controlled key.

1 / 2
Source: MITRE

Remedy

IBM recommends addressing the vulnerability now by upgrading to IBM Langflow Desktop 1.9.0 or newer https://www.langflow.org/blog/langflow-1-9-desktop If you are already using Langflow Desktop, upgrade in the application to version 1.9.0 To install Langflow Desktop for the first time, visit  Langflow Desktop https://langflow.org/desktop . Download https://langflow.org/desktop
First published (updated )
CVE-2026-4503

IBM Langflow DesktopServer-Side Request Forgery (SSRF) in Langflow URL Component

Risk 40
Severity
6.5
SSRF
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

IBM Langflow Desktop 1.0.0 through 1.8.4 IBM Langflow is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

1 / 2
Source: MITRE

Remedy

IBM recommends addressing the vulnerability now by upgrading to IBM Langflow Desktop 1.9.0 or newer https://www.langflow.org/blog/langflow-1-8-desktop If you are already using Langflow Desktop, upgrade in the application to version 1.9.0 To install Langflow Desktop for the first time, visit Download Langflow Desktop https://langflow.org/desktop .
First published (updated )
CVE-2026-3340

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203