CVE-2026-12944criticalCode execution2026-09-14

CVE-2026-12944: Langflow's code scanner missed socket and urllib, letting users run code as root

Langflow OSS 1.0.0 through 1.10.0 blocked subprocess imports in submitted components but not socket or urllib. Code using them ran on the server as root during component validation while the scanner still reported validated: true, so an authenticated user could steal cloud credentials, read container files and reach internal services. Fixed in 1.10.1.

01.

What it is

The DANGEROUS_IMPORTS blocklist in Langflow's code security scanner omitted the socket and urllib standard-library modules. Components calling socket.connect() or urllib.request.urlopen() at module level executed server-side during validation.

IBM says this allows AWS credential theft through IMDSv1 SSRF, exfiltration of files from the container and lateral movement to services such as PostgreSQL and Redis on the Docker network. The scanner returned validated: true, giving a false sense of safety.

02.

How to check

Affected: Langflow OSS 1.0.0 through 1.10.0.
Any logged-in user who can submit components can trigger it.

03.

How to fix

Upgrade Langflow to 1.10.1 or later (1.11.6 or later also fixes CVE-2026-85025 and related bugs). IBM lists no workarounds.
On AWS, require IMDSv2 and rotate any IAM credentials the instance could reach.

pip show langflow | grep -i version

04.

Sources

More advisories for this tool