Severity Daily

IT and AI security incidents, checked against the primary source

Tag: Langflow

  • The vendor record understated the day, and a federal clock runs out tomorrow

    The vendor record understated the day, and a federal clock runs out tomorrow

    The most consequential item on the site today is a Citrix flaw that Citrix still describes as a crash. CVE-2026-8452 is in CISA’s Known Exploited Vulnerabilities catalog with a federal remediation deadline of tomorrow, Saturday 29 August, and two research teams have taken it from an unauthenticated SAML request to a root shell. Citrix’s bulletin CTX696604 has not been updated since 20 July and still calls it a denial-of-service bug. Internet-facing, pre-authentication, a clock that expires in hours, and a vendor description that invites you to defer it — that combination outranks the two items that sound bigger. McKesson filed an 8-K this afternoon and Carhartt’s breach is being counted in the millions. Neither gives anyone anything to do tonight. The NetScaler appliance does.

    The day had a real thread, and it is not a comfortable one: the vendor record kept failing to carry the risk. Citrix labels a root shell a denial of service. Broadcom’s vCenter advisory is at its third revision and still says nothing about exploitation, while a German DFIR firm has mapped 361 victim IP addresses across 47 countries. Microsoft published a CVSS 10.0 Entra ID flaw as exploited and then filed a one-line retraction that much of the coverage never followed. PaperCut’s emergency builds do not appear on PaperCut’s own release history. JFrog’s Artifactory flaw is on a federal clock that the July version most people patched to does not satisfy. And a CVSS 10.0 in ByteDance’s UI-TARS-desktop is remediated by a commit hash rather than a release. Six stories, one failure mode: anyone who triaged today from vendor severity text triaged it wrong.

    Order of business after NetScaler. If you run N-central on premises, or you buy from an MSP that does, that is your first item instead — N-able says in its own words that attackers used Take Control to reach managed endpoints and left Cloudflare tunnels behind, and two rounds of patching were insufficient. Then vCenter, where the persistence chain outlives the patch. Then the rest of the weekend’s clocks: a 2019 SQL Server bug also due tomorrow, though it needs a privileged login to work, and an ownCloud authentication bypass from 2023 plus a Linux kernel container escape due Sunday. PaperCut is under active attack with no CVE at all, which means no KEV entry and no deadline to force it onto anyone’s list.

    Below the clocks: three Langflow code-execution CVEs landed at NVD this evening with no workaround offered and 1.11.2 as the only fix. GPUThor is the day’s best research and the day’s most oversold coverage; it beat NVIDIA’s ECC on four workstation cards, not on the AI fleet. The GitLab exploitation claim rests on one firm’s honeypot data and GitLab has not addressed it; patch anyway, but do not carry the claim as confirmed. And two pieces on the record itself: BOD 22-01 has been dead since June, and this week’s KEV entries carry identical required-action text whether the deadline is three days or fourteen.

    Still open. McKesson’s filing does not say whether data left the company; the statement it gave reporters the same day does, and the two have not been reconciled. Carhartt has said nothing publicly, and the 12.9 million figure is a researcher’s correction, not a company number. Broadcom’s vCenter advisory has been revised twice since the first victim callbacks and still does not mention exploitation. PaperCut still has no CVE. Two federal deadlines land Sunday, on a weekend, which is its own kind of answer about how the three-day band is working.

  • Langflow 1.11.2 fixes three code-execution flaws, one of them unauthenticated, with no workaround offered

    Langflow 1.11.2 fixes three code-execution flaws, one of them unauthenticated, with no workaround offered

    Three code-execution CVEs against Langflow OSS 1.0.0 through 1.11.1 reached NVD late Friday; one needs no credentials, IBM lists no workaround, and the fix is 1.11.2.

    What happened

    NVD published three CVE records for IBM Langflow OSS at 22:16 UTC on 28 August 2026. IBM’s own security bulletin, at ibm.com support node 7284733, is dated 24 August 2026 — five days earlier. So the vendor advisory is not new tonight; the machine-readable records that vulnerability scanners and SBOM tools consume are.

    All three affect Langflow OSS 1.0.0 through 1.11.1, and all three are fixed in 1.11.2. In the bulletin’s workaround field, IBM states: “None.”

    CVE-2026-19286 carries a CVSS 3.1 base score of 9.8 from IBM PSIRT, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, CWE-94. NVD’s description reads: “IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary code due to improper enforcement of security restrictions on the A2A public endpoint.” PR:N is the operative field — no privileges required. IBM’s bulletin frames the condition as the A2A feature being enabled with no authentication requirement.

    CVE-2026-19295 scores 9.9, vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, CWE-95. The description: “IBM Langflow OSS 1.0.0 through 1.11.1 allows an authenticated attacker to execute arbitrary operating system commands in the server process by saving a flow with a crafted type field value and triggering a build of a wrapper flow that references it.” The score is higher than the unauthenticated one because of S:C — scope change, meaning the impact escapes the vulnerable component. Low privileges are required, which in a Langflow deployment means any account that can save a flow.

    CVE-2026-18729 scores 8.8, vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-94: “IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code.”

    Langflow is the open-source visual builder for LLM applications and agent workflows that came to IBM with its acquisition of DataStax. A2A is the agent-to-agent interoperability protocol; the endpoint in question exists so that other agents can reach a Langflow-hosted agent, which is to say it exists to be exposed. There is no reported exploitation of any of the three, and none appears in CISA’s Known Exploited Vulnerabilities catalog as of this writing.

    Why it matters

    Langflow has been here before, and the previous round ended in KEV. CVE-2025-3248, published 7 April 2025, scored 9.8 with the same PR:N profile: “Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code.” CISA added it to the catalog on 5 May 2025 under the name “Langflow Missing Authentication Vulnerability,” with a federal action due date of 26 May 2025. Sixteen months later the product has produced another unauthenticated remote code execution finding, in a different endpoint, with the same root shape: a network-reachable surface that will run code, and an authentication boundary that was not where it needed to be.

    That repetition is the point, and it is not really a Langflow problem. Frameworks in this category execute user-supplied code as their function. A flow builder that could not run arbitrary Python would not be a flow builder. That means the entire security model rests on two things — who can reach the service, and who is allowed to save and build a flow — and both of those are configuration, not code. CWE-94 and CWE-95 findings in a product whose job is generating and running code are not aberrations to be patched away one at a time; they are the expected failure mode of the category, and they should change how the thing is deployed rather than only how promptly it is updated.

    The A2A endpoint sharpens this. Agent interoperability protocols exist to let agents call each other across organizational boundaries, which means the endpoint is designed to be reachable by parties you do not control. The older Langflow KEV entry was for an endpoint that should never have been public and often was. This one is for an endpoint that is meant to be public. That is a harder problem, because the mitigation of last resort for the 2025 flaw — put it behind something — is a partial contradiction of what A2A is for.

    The five-day gap between the bulletin and the CVE records is worth naming too. Between 24 and 28 August, an organization running Langflow could have been fully patched if a human read IBM’s bulletin, and would have shown clean in any tool that matches installed versions against NVD, because there was nothing in NVD to match. This is an ordinary and well-known lag, not misconduct, but it is a reminder that “no findings” from a scanner is a statement about the feed, not about the software. For a product with a KEV history, the vendor’s own bulletin page is worth watching directly.

    One record note, since it will confuse anyone who goes and reads the 2025 entry: the required-action text CISA attached to CVE-2025-3248 tells agencies to “follow applicable BOD 22-01 guidance for cloud services.” BOD 22-01 was superseded and revoked by BOD 26-04 on 10 June 2026, and the boilerplate on older catalog entries has not caught up. We covered that pattern separately in this week’s look at KEV required-action text. It does not change what to do about the 2026 CVEs, which carry no federal deadline because they are not in the catalog.

    Finally, consider what a Langflow instance holds. These deployments accumulate provider API keys, database credentials, and connection strings for whatever the flows talk to, because that is what makes a flow useful. Code execution in the server process is therefore rarely just code execution in the server process. Any incident response here has to assume the secrets configured in the environment are the actual loss, and treat rotation as part of remediation rather than a follow-up item.

    What to do

    Upgrade Langflow OSS to 1.11.2. IBM offers no workaround for any of the three, so there is no supported alternative to updating.

    Before you get there, reduce reach. Inventory every Langflow instance you run, including ones stood up for a demo and never removed, and determine which are reachable from outside your network. If the A2A feature is enabled and you are not actually using agent-to-agent interoperability, disable it. If you are using it, confirm that the endpoint requires authentication rather than relying on the assumption that it does — CVE-2026-19286 exists because that assumption can be wrong.

    Then tighten who can build. Both CVE-2026-19295 and CVE-2026-18729 require only a low-privilege authenticated account, so review who holds Langflow accounts, remove leftover and shared logins, and treat the ability to save a flow as equivalent to shell access on that host, because on 1.11.1 and earlier it is.

    For anything that was internet-facing on an affected version, do not stop at the upgrade. Review server-process logs for unexpected child processes and outbound connections, check for flows you did not create, and rotate every credential and API key stored in or reachable from the instance. If you were running a version below 1.3.0 at any point, also confirm the 2025 issue was actually remediated rather than assumed — that one is in KEV, which means exploitation was documented.

    Sourcing note

    CVE identifiers, descriptions, CVSS vectors and scores, CWE assignments, affected version ranges, and publication timestamps are quoted from NVD’s API records for CVE-2026-19286, CVE-2026-19295, and CVE-2026-18729, each published 28 August 2026 at 22:16 UTC, with CVSS supplied by [email protected]. The fixed version, the affected product range, and the “None” workaround statement come from IBM’s security bulletin at ibm.com support node 7284733, dated 24 August 2026, read directly.

    The 2025 background — CVE-2025-3248’s description, 9.8 score, 7 April 2025 publication, the 5 May 2025 KEV addition, the 26 May 2025 action due date, the catalog name “Langflow Missing Authentication Vulnerability,” and the quoted required-action text — is taken from that CVE’s NVD record, which republishes CISA’s own catalog fields. We did not fetch cisa.gov directly; it returns 403 to automated requests, and NVD’s cisaExploitAdd, cisaActionDue, cisaVulnerabilityName and cisaRequiredAction fields are NIST republishing CISA verbatim.

    Unresolved: none of the three 2026 CVEs has any public exploitation report, proof of concept, or KEV entry that we could find, and IBM’s bulletin does not state whether the issues were found internally or reported externally. We have not independently verified the technical mechanism of any of the three; the descriptions above are the vendor’s and NVD’s. The characterization of Langflow deployments as holding provider credentials is a general property of the product’s design, not a finding about any specific instance.