Threat Library

Langflow OSS versions 1.0.0 through 1.11.2 contain a path traversal flaw in the SaveToFileComponent that lets an authenticated, low-privileged user write files to arbitrary locations on the server via the /api/v1/run/{flow_id} endpoint. This is a classic input validation failure in an agent-building tool component rather than a novel agentic attack, but it can be leveraged to escalate into further server compromise depending on deployment. Severity is moderate due to the authentication requirement, but risk increases sharply in multi-tenant or exposed Langflow deployments.

A stored cross-site scripting vulnerability exists in the Playground chat interface of IBM Langflow OSS, a popular framework for building LLM/agent workflows. An attacker could inject malicious script content that executes in the browser of another user viewing the chat, potentially hijacking sessions or performing actions on their behalf within the Langflow UI.

IBM Langflow OSS versions 1.0.0 through 1.11.1 contain a flaw where user identifiers can collide across namespaces, allowing a remote attacker to access another user's sensitive data or inject messages into their session. This is a serious multi-tenancy isolation failure in a widely used agent-building framework, warranting prompt patching.

A path traversal vulnerability in IBM Langflow OSS (versions 1.0.0 through 1.11.1) allows a remote attacker to read arbitrary files on the host system. Langflow is a visual builder for LLM/agent workflows, so this flaw could expose sensitive configuration, credentials, or agent memory/state files stored on disk. This is a genuine, high-severity infrastructure vulnerability rather than a novel agentic attack technique.

IBM Langflow OSS versions 1.0.0 through 1.11.1 contain an improper authentication flaw that allows a remote attacker to execute arbitrary flows and access sensitive information without valid credentials. This is a genuine, high-impact vulnerability in a widely used agent/LLM orchestration framework that could let attackers run arbitrary agent pipelines and exfiltrate data. Organizations running affected versions should patch immediately.

IBM Langflow OSS versions 1.0.0 through 1.11.1 contain a server-side request forgery (SSRF) vulnerability that allows an authenticated attacker to make the server send unauthorized requests to internal or external systems. This could be used for internal network reconnaissance or as a stepping stone for further attacks, but requires authentication and has moderate severity per its CVSS score of 4.3.

IBM Langflow versions 1.0.0 through 1.11.1 contain a critical flaw in the Agent-to-Agent (A2A) public endpoint that fails to properly enforce security restrictions, allowing a remote unauthenticated attacker to execute arbitrary code. With a CVSS score of 9.8, this is a severe, easily exploitable vulnerability that could grant full control of the affected system.

A missing authorization check in Dradis Community Edition lets any authenticated non-admin user redirect the built-in Roslin AI agent to an arbitrary attacker-controlled or internal URL. This creates a server-side request forgery vulnerability whose responses are reflected back to the attacker, enabling access to internal services and cloud metadata endpoints like AWS IMDS.

Omnigent, an open-source AI agent orchestration framework, fails to validate the os_env.cwd field in uploaded agent bundles, allowing an authenticated user to supply an absolute or traversal path. When the runner has no configured workspace root, this attacker-controlled path becomes the trusted root for file and shell tools, letting an agent read, write, or execute outside its intended sandbox and potentially exfiltrate host secrets.

Omnigent, an open-source AI agent orchestration framework, contains a shell-command parser that fails to recognize certain command syntax (combined flags, timing wrappers, command substitution, background operators). This causes the framework's git/gh write allowlist and workspace confinement policies to silently abstain rather than block, letting an agent push to unauthorized repositories or branches or escape its intended working directory. A prompt-injected or otherwise manipulated coding agent could exploit this gap to perform unauthorized writes outside its granted scope.

IBM Langflow versions 1.0.0 through 1.10.0 expose a registration endpoint without proper authentication, allowing a remote attacker to overwrite the administrator's email address and abuse the server to send outbound mail as a relay. Because Langflow is widely used to build and orchestrate LLM agent flows, compromising its admin identity could give an attacker control over flow configuration, credentials, and connected tools.

Langflow, an open-source framework used to visually build LLM/agent workflows, contains a flaw allowing unlimited authentication attempts, enabling remote attackers to brute-force user credentials. Given a 9.1 CVSS score, successful exploitation could grant unauthorized access to accounts controlling agent pipelines, connected tools, and stored credentials/secrets.

A vulnerability in Trigger.dev, a platform for orchestrating managed AI agents and workflows, allows any authenticated tenant to pollute Object.prototype in the shared webapp process via a metadata update API. This corrupts database queries and metrics across all tenants and can break worker authentication or crash the process, resulting in a cross-tenant denial-of-service condition. The issue is fixed in version 4.5.6.

IBM Langflow, an open-source visual builder for AI agent workflows, has a flaw in its ensure_fernet_key() function that produces weak cryptographic keys used to encrypt sensitive data such as credentials and secrets. This weakens the confidentiality guarantees of stored secrets, potentially allowing an attacker to decrypt or brute-force protected data if they gain access to the encrypted material. This is a genuine framework-level security issue affecting confidentiality of agent configuration/secrets rather than a direct agent-behavior exploit.

IBM Langflow OSS versions 1.0.0 through 1.10.3 use Python's non-cryptographic Mersenne Twister PRNG to derive Fernet encryption keys from short user secrets, making key generation deterministic and predictable. An attacker who can predict or brute-force the seed can regenerate the encryption key and decrypt stored API keys and authentication tokens used by the agent platform.

IBM Langflow's model provider validation function passes a user-supplied Ollama base URL directly into an outbound HTTP request without any scheme, host, or IP range validation. This allows an attacker to force the Langflow server to make requests to internal services, loopback addresses, or cloud metadata endpoints, potentially leaking credentials or enabling further internal network reconnaissance.

Langflow OSS, a framework used to build AI agent and LLM workflows, contains a server-side request forgery vulnerability caused by incomplete SSRF protections. An attacker able to supply URLs or trigger outbound requests through Langflow components could force the server to reach internal or restricted network resources.

IBM Langflow OSS versions 1.0.0 through 1.10.3 contain a vulnerability that allows a remote attacker to execute arbitrary code by exploiting improper validation of configuration parameters. Since Langflow is used to build and orchestrate AI agent workflows, a compromise here could give an attacker control over the host running agent pipelines. Organizations running affected versions should patch immediately given the high severity and remote, unauthenticated attack potential implied by the CVSS score.

A vulnerability in IBM Langflow OSS allows authenticated remote attackers to bypass localhost-only access controls and write arbitrary MCP server configurations into IDE config files on the host. This effectively lets an attacker plant malicious MCP servers that will be trusted and loaded by developer tooling, turning a web-facing Langflow instance into a foothold for compromising the developer's local environment.

IBM Langflow's handling of Docker-based MCP servers fails to properly filter dangerous volume-mount and device-mapping arguments, allowing an authenticated attacker to read, modify, or expose sensitive files on the host system. This is a high-severity flaw because it lets an already-authenticated but otherwise limited user escalate to host-level file access by abusing Langflow's MCP server tooling integration.