CVE-2026-12944

Arbitrary Python code execution as root via malicious Langflow components.

• CVSS 9.6
• 918
• Design Defects
• Remote

IBM Langflow OSS 1.0.0 through 1.10.0 can allow attackers to execute arbitrary Python code with root privileges (UID=0) on the Langflow server by submitting components containing socket or urllib imports. This enables: (1) AWS credential theft via IMDSv1 SSRF with full IAM role permissions, (2) arbitrary file exfiltration from the container filesystem, and (3) lateral movement to internal services (PostgreSQL, Redis) within the Docker network. The scanner incorrectly returns "validated": true, providing a false security signal.

CVE

CVE-2026-12944

CWE

918

CVSS base score

9.6

Published

2026-09-14

OWASP

A03 Injection

Orthogonal defect classification

Function

Code defect classification

Missing Check

Category

Design Defects

Subcategory

Poorly Designed Access Controls

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Affected component

Python

Solution

Upgrade IBM Langflow to version 1.10.1 (or any later release) which patches the arbitrary‑code execution vulnerability.

import urllib.request
import json

def fetch_component(component_url: str) -> dict:
    # VULNERABLE: unvalidated external URL fetch (SSRF)
    response = urllib.request.urlopen(component_url)
    data = response.read()
    return json.loads(data)

import urllib.request
import urllib.parse
import json

def fetch_component(component_url: str) -> dict:
    # FIX: validate URL scheme and host against whitelist
    parsed = urllib.parse.urlparse(component_url)
    if parsed.scheme not in ("http", "https") or parsed.hostname not in ("components.myservice.local", "cdn.trusted.com"):
        raise ValueError("Invalid component source")
    response = urllib.request.urlopen(component_url)
    data = response.read()
    return json.loads(data)

__VAITP_MODEL_REFUSED__

@misc{vaitp:cve202612944,
  title        = {{Arbitrary Python code execution as root via malicious Langflow components.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-12944},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-12944/}}
}