A critical flaw in IBM Langflow OSS 1.0.0 through 1.10.0 is reported to let attackers with low-privilege access run arbitrary Python code as root on the Langflow server, with the built-in scanner reportedly marking the malicious component as validated.
What Is It
CVE-2026-12944 is a code-validation bypass in IBM Langflow OSS. By submitting components containing socket or urllib imports, an attacker is reported to be able to execute arbitrary Python code with root privileges (UID=0) on the Langflow server.
IBM's advisory tags the issue as CWE-918 (Server-Side Request Forgery) and rates it CVSS 3.1 base score 9.6 (CRITICAL), vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N, network-reachable, low attack complexity, no user interaction, and a changed scope reflecting impact beyond the vulnerable component itself.
These two characterizations do not line up. CWE-918 and the A:N availability rating describe an SSRF-shaped issue, while unrestricted root-level code execution would normally carry A:H, since an attacker running arbitrary code as UID 0 can trivially stop the service. Either the assigned weakness class and vector understate the impact, or the "root code execution" framing overstates what the bypass actually yields. NVD analysis is not yet complete (see Patch Status), so there is no independent scoring to arbitrate between them. Treat the severity as credible and the precise impact class as unsettled.
A compounding problem is reported: the scanner returns "validated": true for these components, giving operators a false signal that the submitted code is safe. This behavior comes from the vulnerability report rather than from the NVD record or IBM's published advisory text, and is not independently confirmed by either source below.
Why It Matters
If the root-execution characterization holds, the reported attack paths are:
- AWS credential theft via IMDSv1 SSRF, yielding the permissions of the attached IAM role. This requires the instance to expose IMDSv1 (IMDSv2's session-token requirement blocks the classic SSRF path) and to have an IAM role attached with meaningful permissions.
- Arbitrary file exfiltration from the container filesystem, bounded by what that container actually holds.
- Lateral movement to internal services such as PostgreSQL and Redis, where those services are reachable within the same Docker network and not otherwise segmented or authenticated.
None of these are automatic consequences of the flaw; each is a property of how a given instance is deployed. Where the preconditions do hold, the chain would turn a single low-privilege Langflow account into cloud credential compromise and internal network access. As with the scanner behavior, these attack paths trace to the vulnerability report and are not enumerated in the two sources linked below.
The false "validated" response, if confirmed, matters just as much: defenders relying on the scanner's verdict would have no signal that anything is wrong.
What's Vulnerable
- Vendor: IBM
- Product: Langflow OSS
- Affected versions: 1.0.0 through 1.10.0 (semver range, inclusive)
Privileges required are LOW: the attacker needs some level of access to submit components, but not administrative rights.
Patch Status
CVE-2026-12944 was published 2026-09-14 by IBM PSIRT and currently carries NVD status Received, meaning NVD analysis is not yet complete. The supplied data contains no CISA KEV entry, so there is no confirmation of active exploitation and no KEV-mandated remediation deadline.
No specific fixed version is stated in the supplied material. Operators should consult IBM's advisory for remediation guidance and treat any Langflow OSS deployment in the 1.0.0–1.10.0 range as exposed; particularly instances running as root in containers with IAM roles attached or network reachability to internal data stores. Enforcing IMDSv2, dropping root in the container, and segmenting Langflow from internal data stores each narrow the reported chain independently of a vendor fix.
Sources
- NVD, CVE-2026-12944: https://nvd.nist.gov/vuln/detail/CVE-2026-12944
- IBM Support Advisory (node 7278919): https://www.ibm.com/support/pages/node/7278919