Threat Library

IBM Langflow OSS versions 1.0.0 through 1.11.1 contain a flaw where user identifiers can collide across namespaces, allowing a remote attacker to access another user's sensitive data or inject messages into their session. This is a serious multi-tenancy isolation failure in a widely used agent-building framework, warranting prompt patching.

A path traversal vulnerability in IBM Langflow OSS (versions 1.0.0 through 1.11.1) allows a remote attacker to read arbitrary files on the host system. Langflow is a visual builder for LLM/agent workflows, so this flaw could expose sensitive configuration, credentials, or agent memory/state files stored on disk. This is a genuine, high-severity infrastructure vulnerability rather than a novel agentic attack technique.

IBM Langflow OSS versions 1.0.0 through 1.11.1 contain an improper authentication flaw that allows a remote attacker to execute arbitrary flows and access sensitive information without valid credentials. This is a genuine, high-impact vulnerability in a widely used agent/LLM orchestration framework that could let attackers run arbitrary agent pipelines and exfiltrate data. Organizations running affected versions should patch immediately.

A missing authorization check in Dradis Community Edition lets any authenticated non-admin user redirect the built-in Roslin AI agent to an arbitrary attacker-controlled or internal URL. This creates a server-side request forgery vulnerability whose responses are reflected back to the attacker, enabling access to internal services and cloud metadata endpoints like AWS IMDS.

Omnigent, an open-source AI agent orchestration framework, fails to validate the os_env.cwd field in uploaded agent bundles, allowing an authenticated user to supply an absolute or traversal path. When the runner has no configured workspace root, this attacker-controlled path becomes the trusted root for file and shell tools, letting an agent read, write, or execute outside its intended sandbox and potentially exfiltrate host secrets.

Omnigent, an open-source AI agent orchestration framework, contains a shell-command parser that fails to recognize certain command syntax (combined flags, timing wrappers, command substitution, background operators). This causes the framework's git/gh write allowlist and workspace confinement policies to silently abstain rather than block, letting an agent push to unauthorized repositories or branches or escape its intended working directory. A prompt-injected or otherwise manipulated coding agent could exploit this gap to perform unauthorized writes outside its granted scope.

IBM Langflow versions 1.0.0 through 1.10.0 expose a registration endpoint without proper authentication, allowing a remote attacker to overwrite the administrator's email address and abuse the server to send outbound mail as a relay. Because Langflow is widely used to build and orchestrate LLM agent flows, compromising its admin identity could give an attacker control over flow configuration, credentials, and connected tools.

A vulnerability in Trigger.dev, a platform for orchestrating managed AI agents and workflows, allows any authenticated tenant to pollute Object.prototype in the shared webapp process via a metadata update API. This corrupts database queries and metrics across all tenants and can break worker authentication or crash the process, resulting in a cross-tenant denial-of-service condition. The issue is fixed in version 4.5.6.

IBM Langflow, an open-source visual builder for AI agent workflows, has a flaw in its ensure_fernet_key() function that produces weak cryptographic keys used to encrypt sensitive data such as credentials and secrets. This weakens the confidentiality guarantees of stored secrets, potentially allowing an attacker to decrypt or brute-force protected data if they gain access to the encrypted material. This is a genuine framework-level security issue affecting confidentiality of agent configuration/secrets rather than a direct agent-behavior exploit.

IBM Langflow OSS versions 1.0.0 through 1.10.3 use Python's non-cryptographic Mersenne Twister PRNG to derive Fernet encryption keys from short user secrets, making key generation deterministic and predictable. An attacker who can predict or brute-force the seed can regenerate the encryption key and decrypt stored API keys and authentication tokens used by the agent platform.

IBM Langflow's model provider validation function passes a user-supplied Ollama base URL directly into an outbound HTTP request without any scheme, host, or IP range validation. This allows an attacker to force the Langflow server to make requests to internal services, loopback addresses, or cloud metadata endpoints, potentially leaking credentials or enabling further internal network reconnaissance.

IBM Langflow OSS versions 1.0.0 through 1.10.3 contain a vulnerability that allows a remote attacker to execute arbitrary code by exploiting improper validation of configuration parameters. Since Langflow is used to build and orchestrate AI agent workflows, a compromise here could give an attacker control over the host running agent pipelines. Organizations running affected versions should patch immediately given the high severity and remote, unauthenticated attack potential implied by the CVSS score.

A vulnerability in IBM Langflow OSS allows authenticated remote attackers to bypass localhost-only access controls and write arbitrary MCP server configurations into IDE config files on the host. This effectively lets an attacker plant malicious MCP servers that will be trusted and loaded by developer tooling, turning a web-facing Langflow instance into a foothold for compromising the developer's local environment.

IBM Langflow's handling of Docker-based MCP servers fails to properly filter dangerous volume-mount and device-mapping arguments, allowing an authenticated attacker to read, modify, or expose sensitive files on the host system. This is a high-severity flaw because it lets an already-authenticated but otherwise limited user escalate to host-level file access by abusing Langflow's MCP server tooling integration.

IBM Langflow, an open-source framework used to build AI agent and LLM workflows, contains a path traversal flaw in versions 1.0.0 through 1.10.1. A remote, unauthenticated attacker can craft a URL request with '../' sequences to read arbitrary files on the host system, potentially exposing credentials, API keys, or configuration data used by connected agents and tools.

IBM Langflow OSS versions 1.0.0 through 1.10.1 contain an improper access control flaw that lets authenticated users view and manipulate other users' agent flow build jobs and logs, and exposes some build endpoints without authentication at all. This is a genuine vulnerability with a moderate-high CVSS score (7.1), primarily impacting confidentiality and integrity of multi-tenant Langflow deployments rather than enabling remote code execution directly.

n8n's HTML preview feature renders workflow output into an iframe without a sandbox attribute, allowing a sanitizer bypass to execute attacker-controlled script in the same origin as the editor. Since n8n orchestrates automated workflows and often integrates with AI agents and external data sources, this could let an attacker with low-privilege access (global:member) hijack an authenticated user's session to call privileged APIs. The vendor has released patched versions and interim mitigations via CSP hardening.

n8n's Resource Locator UI passes a workflow-persisted URL field (cachedResultUrl) directly into window.open() without validating the URI scheme, allowing a malicious workflow to execute attacker-controlled JavaScript in a victim's browser when they interact with a crafted link. This is a stored XSS issue in the n8n web application rather than a direct compromise of an AI agent's reasoning, but since n8n is widely used to orchestrate AI/LLM agent workflows, exploitation could let an attacker pivot from the browser context into workflow credentials, connected integrations, or agent control surfaces. Official patches are available (1.123.64, 2.29.8, 2.30.1).

CISA added four actively exploited vulnerabilities to its KEV Catalog, one of which (CVE-2026-0770) affects Langflow, a framework used to build AI agent/LLM workflows, involving inclusion of functionality from an untrusted control sphere. The other three CVEs concern DD-WRT and WordPress and are unrelated to AI agent infrastructure. This is a legitimate, actively exploited vulnerability disclosure relevant to organizations running Langflow-based agent pipelines, warranting prompt patching per federal directive BOD 26-04.

AgenticMail, a platform that gives AI agents real email addresses and phone numbers, contained a cluster of validation and security-control weaknesses across its API and core packages. These include SQL identifier injection risks, insufficient SMTP header/envelope sanitization enabling command injection, fail-open secret handling, and TLS verification defaulting incorrectly in some configurations. Combined, these flaws could let an attacker manipulate agent-controlled email infrastructure, access or corrupt storage metadata, inject SMTP commands, or intercept traffic via weakened TLS defaults.