Langflow OSS: submitted components run arbitrary Python as root on the server

Impact

Langflow runs user-authored flow components in-process, and versions 1.0.0 through 1.10.0 let a component that imports socket or urllib escape the validator and execute arbitrary Python as UID 0 inside the Langflow container. IBM reports the concrete consequences as theft of cloud credentials via IMDSv1 SSRF with the full IAM role attached to the instance, exfiltration of any file in the container, and lateral movement to PostgreSQL and Redis on the same Docker network. On a fleet this matters because Langflow is usually the shared front door to GPU-backed model endpoints: one authenticated flow author gets the node's cloud identity and whatever is reachable from the serving network. The validator additionally returns "validated": true for these components, so an operator relying on it gets a false clean signal.

Who can reach it

Any authenticated Langflow user who can create or submit a component (CVSS says network, low privileges, no user interaction). Scope is marked changed because the code runs as root and reaches services beyond Langflow itself.

What to do

Upgrade Langflow OSS past 1.10.0 per IBM's advisory and restart the service; the record does not name a fixed version, so confirm the target release in the IBM bulletin before scheduling. Until then treat any Langflow instance as equivalent to root on its host: do not run it as root, put it on a network segment with no access to PostgreSQL, Redis or the cloud metadata endpoint, enforce IMDSv2, and restrict who may author components. This is a container/service restart, not a node drain.

References

Related entries

• Transformers: LightGlue config re-enables trust_remote_code from the model repo, executing repo code at loadCVE-2026-5241 · Hugging Face Transformers 5.2.0 (LightGlue config loading, trust_remote_code propagation)Critical
• Gradio: Remotely triggerable local file include via a JSON value in an API requestCVE-2024-0964 · GradioCritical
• Ray (dashboard job submission API, browser-origin guard): Ray's only defense against browser-driven job submission wasCVE-2025-62593 · Ray (dashboard job submission API, browser-origin guard)Critical
• Flowise: SQLite Record Manager config override gives an authenticated user root code execution in the containerCVE-2026-69259 · Flowise SQLite Record Manager node (additionalConfig database path override)Critical
• Flowise: custom-function sandbox escape via puppeteer.launch gives command execution as the Flowise userCVE-2026-73483 · Flowise (/api/v1/node-custom-function, vm2/@flowiseai/nodevm sandbox)Critical
• TensorFlow / Keras: Arbitrary code execution via unsafe YAML deserialization of model configCVE-2021-37678 · TensorFlow / KerasCritical