Loading vulnerability…
SSRF and Root Python Code Execution in IBM Langflow OSS Flow Validator
CVE-2026-12944 is an incomplete dangerous-import control in the IBM Langflow OSS flow-validation security scanner affecting versions 1.0.0 through 1.10.0. The scanner's blocklist omits Python socket and urllib modules. An authenticated user can submit a custom component containing these imports and module-level network operations; those operations execute server-side during component validation even when the scanner reports the component as validated. The condition enables SSRF and arbitrary Python execution in the Langflow container, where the affected process runs as UID 0.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker can execute arbitrary Python code as root in the Langflow container. Resulting access can be used to query cloud metadata services and obtain AWS IAM-role credentials where IMDSv1 is reachable, exfiltrate files from the container filesystem, establish outbound reverse-shell connectivity, and access or pivot to internal Docker-network services such as PostgreSQL and Redis. The CVSS v3.1 base score is 9.6 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).
If you can’t patch tonight, do this now.
No vendor workaround is available. Until the upgrade is completed, restrict custom-component submission to tightly trusted authenticated users, limit the Langflow container's outbound network access and access to cloud metadata endpoints, and segment access to internal services reachable from the container.
Patch, then assume compromise.
Upgrade IBM Langflow OSS to version 1.10.1 or a later version containing the corrected security scanner. IBM lists no workaround for affected releases.
2 exploits validated by Mallory's analysis.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.