Three code-execution CVEs against Langflow OSS 1.0.0 through 1.11.1 reached NVD late Friday; one needs no credentials, IBM lists no workaround, and the fix is 1.11.2.
What happened
NVD published three CVE records for IBM Langflow OSS at 22:16 UTC on 28 August 2026. IBM’s own security bulletin, at ibm.com support node 7284733, is dated 24 August 2026 — five days earlier. So the vendor advisory is not new tonight; the machine-readable records that vulnerability scanners and SBOM tools consume are.
All three affect Langflow OSS 1.0.0 through 1.11.1, and all three are fixed in 1.11.2. In the bulletin’s workaround field, IBM states: “None.”
CVE-2026-19286 carries a CVSS 3.1 base score of 9.8 from IBM PSIRT, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, CWE-94. NVD’s description reads: “IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary code due to improper enforcement of security restrictions on the A2A public endpoint.” PR:N is the operative field — no privileges required. IBM’s bulletin frames the condition as the A2A feature being enabled with no authentication requirement.
CVE-2026-19295 scores 9.9, vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, CWE-95. The description: “IBM Langflow OSS 1.0.0 through 1.11.1 allows an authenticated attacker to execute arbitrary operating system commands in the server process by saving a flow with a crafted type field value and triggering a build of a wrapper flow that references it.” The score is higher than the unauthenticated one because of S:C — scope change, meaning the impact escapes the vulnerable component. Low privileges are required, which in a Langflow deployment means any account that can save a flow.
CVE-2026-18729 scores 8.8, vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-94: “IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code.”
Langflow is the open-source visual builder for LLM applications and agent workflows that came to IBM with its acquisition of DataStax. A2A is the agent-to-agent interoperability protocol; the endpoint in question exists so that other agents can reach a Langflow-hosted agent, which is to say it exists to be exposed. There is no reported exploitation of any of the three, and none appears in CISA’s Known Exploited Vulnerabilities catalog as of this writing.
Why it matters
Langflow has been here before, and the previous round ended in KEV. CVE-2025-3248, published 7 April 2025, scored 9.8 with the same PR:N profile: “Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code.” CISA added it to the catalog on 5 May 2025 under the name “Langflow Missing Authentication Vulnerability,” with a federal action due date of 26 May 2025. Sixteen months later the product has produced another unauthenticated remote code execution finding, in a different endpoint, with the same root shape: a network-reachable surface that will run code, and an authentication boundary that was not where it needed to be.
That repetition is the point, and it is not really a Langflow problem. Frameworks in this category execute user-supplied code as their function. A flow builder that could not run arbitrary Python would not be a flow builder. That means the entire security model rests on two things — who can reach the service, and who is allowed to save and build a flow — and both of those are configuration, not code. CWE-94 and CWE-95 findings in a product whose job is generating and running code are not aberrations to be patched away one at a time; they are the expected failure mode of the category, and they should change how the thing is deployed rather than only how promptly it is updated.
The A2A endpoint sharpens this. Agent interoperability protocols exist to let agents call each other across organizational boundaries, which means the endpoint is designed to be reachable by parties you do not control. The older Langflow KEV entry was for an endpoint that should never have been public and often was. This one is for an endpoint that is meant to be public. That is a harder problem, because the mitigation of last resort for the 2025 flaw — put it behind something — is a partial contradiction of what A2A is for.
The five-day gap between the bulletin and the CVE records is worth naming too. Between 24 and 28 August, an organization running Langflow could have been fully patched if a human read IBM’s bulletin, and would have shown clean in any tool that matches installed versions against NVD, because there was nothing in NVD to match. This is an ordinary and well-known lag, not misconduct, but it is a reminder that “no findings” from a scanner is a statement about the feed, not about the software. For a product with a KEV history, the vendor’s own bulletin page is worth watching directly.
One record note, since it will confuse anyone who goes and reads the 2025 entry: the required-action text CISA attached to CVE-2025-3248 tells agencies to “follow applicable BOD 22-01 guidance for cloud services.” BOD 22-01 was superseded and revoked by BOD 26-04 on 10 June 2026, and the boilerplate on older catalog entries has not caught up. We covered that pattern separately in this week’s look at KEV required-action text. It does not change what to do about the 2026 CVEs, which carry no federal deadline because they are not in the catalog.
Finally, consider what a Langflow instance holds. These deployments accumulate provider API keys, database credentials, and connection strings for whatever the flows talk to, because that is what makes a flow useful. Code execution in the server process is therefore rarely just code execution in the server process. Any incident response here has to assume the secrets configured in the environment are the actual loss, and treat rotation as part of remediation rather than a follow-up item.
What to do
Upgrade Langflow OSS to 1.11.2. IBM offers no workaround for any of the three, so there is no supported alternative to updating.
Before you get there, reduce reach. Inventory every Langflow instance you run, including ones stood up for a demo and never removed, and determine which are reachable from outside your network. If the A2A feature is enabled and you are not actually using agent-to-agent interoperability, disable it. If you are using it, confirm that the endpoint requires authentication rather than relying on the assumption that it does — CVE-2026-19286 exists because that assumption can be wrong.
Then tighten who can build. Both CVE-2026-19295 and CVE-2026-18729 require only a low-privilege authenticated account, so review who holds Langflow accounts, remove leftover and shared logins, and treat the ability to save a flow as equivalent to shell access on that host, because on 1.11.1 and earlier it is.
For anything that was internet-facing on an affected version, do not stop at the upgrade. Review server-process logs for unexpected child processes and outbound connections, check for flows you did not create, and rotate every credential and API key stored in or reachable from the instance. If you were running a version below 1.3.0 at any point, also confirm the 2025 issue was actually remediated rather than assumed — that one is in KEV, which means exploitation was documented.
Sourcing note
CVE identifiers, descriptions, CVSS vectors and scores, CWE assignments, affected version ranges, and publication timestamps are quoted from NVD’s API records for CVE-2026-19286, CVE-2026-19295, and CVE-2026-18729, each published 28 August 2026 at 22:16 UTC, with CVSS supplied by [email protected]. The fixed version, the affected product range, and the “None” workaround statement come from IBM’s security bulletin at ibm.com support node 7284733, dated 24 August 2026, read directly.
The 2025 background — CVE-2025-3248’s description, 9.8 score, 7 April 2025 publication, the 5 May 2025 KEV addition, the 26 May 2025 action due date, the catalog name “Langflow Missing Authentication Vulnerability,” and the quoted required-action text — is taken from that CVE’s NVD record, which republishes CISA’s own catalog fields. We did not fetch cisa.gov directly; it returns 403 to automated requests, and NVD’s cisaExploitAdd, cisaActionDue, cisaVulnerabilityName and cisaRequiredAction fields are NIST republishing CISA verbatim.
Unresolved: none of the three 2026 CVEs has any public exploitation report, proof of concept, or KEV entry that we could find, and IBM’s bulletin does not state whether the issues were found internally or reported externally. We have not independently verified the technical mechanism of any of the three; the descriptions above are the vendor’s and NVD’s. The characterization of Langflow deployments as holding provider credentials is a general property of the product’s design, not a finding about any specific instance.