CVE-2026-18891: falha de alta gravidade em IBM Langflow OSS
Langflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulnerabilities
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.2epss 0.5%
IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary flows and access sensitive information due to improper authentication.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Produtos afetados
IBM · Langflow OSSCVEs relacionadas — IBM Langflow OSS
No mesmo produto, das mais perigosas para as menos.
CVE-2026-9198CRITICALUnauthenticated Remote Code Execution via Auto-Login Bypass and Code ValidationEPSS 28.7%KEVCVE-2026-93674CRITICALLangflow OSS is affected by multiple vulnerabilitiesEPSS 15.3%CVE-2026-7873CRITICALCode Injection Vulnerability in Code Validation EndpointEPSS 6.9%CVE-2026-9103CRITICALUnauthenticated Superuser Token Issuance via Auto-Login EndpointEPSS 3.2%CVE-2026-10134CRITICALUnauthenticated Server-Side RCE via PythonCodeStructuredTool in Public FlowsEPSS 2.3%CVE-2026-93680CRITICALLangflow OSS is affected by multiple vulnerabilitiesEPSS 2.2%