## What Happened
IBM X-Force disclosed two vulnerabilities in Langflow OSS, including a critical issue, CVE-2026-12944 (CVSS 9.6). The flaw allows authenticated users to submit components that execute server-side during validation, enabling network access and potential credential theft.
## Technical Details
- CVE-2026-12944 is described as an incomplete security scanner blocklist.
- The scanner blocks dangerous Python modules like subprocess, but fails to block socket and urllib.
- Authenticated users can submit components containing socket.connect() or urllib.request.urlopen() at module level, which executes server-side during component validation.
- The advisory states the code can run with root privileges inside the container, enabling reverse shells and local file exfiltration.
- CVE-2026-17628 (CVSS 5.4) involves improper authentication in the password reset endpoint, where the API accepts new passwords without verifying the current credential.
## Affected
- CVE-2026-12944: Langflow OSS versions 1.0.0 through 1.10.0
- CVE-2026-17628: Langflow OSS versions 1.0.0 through 1.10.2
## Impact
- Potential extraction of sensitive AWS IAM role permissions via the SSRF/RCE path.
- Ability to pivot to internal services such as PostgreSQL and Redis.
- Potential reverse shell establishment and local file exfiltration.
- For CVE-2026-17628, session hijacking could allow attackers to reset passwords and lock out legitimate users.
- The article states no confirmed exploitation yet for either vulnerability.
## Mitigation
1. Upgrade Langflow OSS to 1.10.3 (IBM advises upgrading immediately), which resolves both the scanner blocklist failure and the password reset defect.
2. Apply vendor advisories and ensure self-hosted Langflow instances are updated without delay.