Langflow OSS: submitted components run arbitrary Python as root on the server

Impact

Langflow runs user-authored flow components in-process, and versions 1.0.0 through 1.10.0 let a component that imports socket or urllib escape the validator and execute arbitrary Python as UID 0 inside the Langflow container. IBM reports the concrete consequences as theft of cloud credentials via IMDSv1 SSRF with the full IAM role attached to the instance, exfiltration of any file in the container, and lateral movement to PostgreSQL and Redis on the same Docker network. On a fleet this matters because Langflow is usually the shared front door to GPU-backed model endpoints: one authenticated flow author gets the node's cloud identity and whatever is reachable from the serving network. The validator additionally returns "validated": true for these components, so an operator relying on it gets a false clean signal.

Who can reach it

Any authenticated Langflow user who can create or submit a component (CVSS says network, low privileges, no user interaction). Scope is marked changed because the code runs as root and reaches services beyond Langflow itself.

What to do

Upgrade Langflow OSS past 1.10.0 per IBM's advisory and restart the service; the record does not name a fixed version, so confirm the target release in the IBM bulletin before scheduling. Until then treat any Langflow instance as equivalent to root on its host: do not run it as root, put it on a network segment with no access to PostgreSQL, Redis or the cloud metadata endpoint, enforce IMDSv2, and restrict who may author components. This is a container/service restart, not a node drain.

References

Related entries

• MLflow Assistant: missing origin validation lets a web page drive the local Assistant into command executionCVE-2026-2611 · MLflow Assistant /ajax-api endpoints (origin validation)Critical
• Transformers: LightGlue config re-enables trust_remote_code from the model repo, executing repo code at loadCVE-2026-5241 · Hugging Face Transformers 5.2.0 (LightGlue config loading, trust_remote_code propagation)Critical
• Langflow: file-ingest components read any absolute path on the host before 1.9.2CVE-2026-55447 · Langflow file-ingest components (BaseFileComponent)Critical
• GitLab MCP server: attacker-supplied API URL header exfiltrates the configured GitLab tokenCVE-2026-61559 · @zereight/mcp-gitlab MCP server (X-GitLab-API-URL dynamic base URL)Critical
• GitLab MCP server: DNS rebinding reaches the Streamable HTTP endpoint from a web pageCVE-2026-61568 · @zereight/mcp-gitlab MCP server (Streamable HTTP endpoint, Host/Origin validation)Critical
• Gradio: Remotely triggerable local file include via a JSON value in an API requestCVE-2024-0964 · GradioCritical