CVE-2026-12944

Langflow component validation can execute network-capable Python imports

IBM / Langflow · Langflow OSS

First documented disclosure · Review checkpoint

Summary

Submitted component code can run during validation even when the scanner reports that the component passed.

Severity and exploitation evidence

Critical · 9.6/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed IBM bulletin and CNA record do not document malicious exploitation or an affected customer.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The scanner blocked subprocess but omitted socket and urllib. Module-level Python in the submitted component runs as part of the validation path.

Conditions required

An authenticated user can submit component code for validation. Files, metadata and internal services must be reachable from the validation process for the corresponding effects.

Potential impact

Code runs with the service’s privileges. IBM describes root in the reported container, file exfiltration and possible theft of workload credentials where cloud metadata is accessible.

Affected versions and configurations

1.0.0 through 1.10.0, inclusive, according to IBM.

Fix and mitigation status

1.10.1 addresses this issue according to IBM.

Practical next steps

Upgrade to a supported release containing the 1.10.1 fix. Isolate validation workers, constrain egress and restrict access to instance credentials.

Operating lesson

Treat component validation as code execution when it imports the submitted module.

Evidence and limits

A June 23 public patch documents the omitted imports and identifies them as a follow-up to CVE-2026-33873. IBM separately identifies this path as CVE-2026-12944 in its July 2 bulletin and September CNA. Root privileges and cloud credential access depend on deployment.

Sources