IBM Filed Eight More Langflow CVEs Yesterday. That's 111 in Five Months.
CVE-2026-19295 (CVSS 9.9) landed August 28 as part of the sixth straight month of double-digit Langflow disclosures. The pattern is real and verifiable in our own index — but only 6 of the 128 CVEs ever filed against this product have been confirmed exploited.
On August 28, IBM's PSIRT filed eight new CVEs against Langflow OSS, the open-source visual builder for AI agents and LLM pipelines that IBM now maintains. The worst of the batch, CVE-2026-19295, scores a 9.9 and lets an authenticated user escalate to arbitrary OS command execution on the server. It's not an isolated event — it's the sixth straight month Langflow has racked up double-digit disclosures, and our index now carries 128 CVEs that mention the product. This piece is about what that volume actually tells you, and what it doesn't.
Why the count keeps climbing
Langflow's CVE volume isn't a single research group hammering one codebase. IBM's own PSIRT files large batches on a recurring cadence (August 5, July 17, June 30, June 23 all saw double-digit drops), but outside researchers keep finding new classes of bugs independently: Tenable and Dynatrace have both been credited on Langflow RCE chains this year, and the product's core exposure — it lets authenticated, and sometimes unauthenticated, users submit code that the server then executes as part of building an AI "flow" — keeps producing new variations on the same theme: auth bypass chained into code execution.
| Label | Value |
|---|---|
| Jan | 6 |
| Feb | 1 |
| Mar | 8 |
| Apr | 13 |
| May | 5 |
| Jun | 25 |
| Jul | 26 |
| Aug | 34 |
What actually shipped on August 28
| CVE | CVSS | Weakness | What it allows |
|---|---|---|---|
| CVE-2026-19295 | 9.9 | CWE-95 (Eval Injection) | Authenticated user escalates to arbitrary OS command execution via a crafted flow type field |
| CVE-2026-19286 | 9.8 | CWE-94 (Code Injection) | Remote code execution via improperly restricted A2A public endpoint |
| CVE-2026-19294 | 6.4 | Improper Authorization | Authenticated user reads or executes another user's private flow |
| CVE-2026-18904 | 8.2 | Namespace Collision | Sensitive info disclosure and unauthorized message injection via user-ID collision |
| CVE-2026-18899 | 7.5 | Path Traversal | Remote attacker reads arbitrary files |
| CVE-2026-18891 | 8.2 | Improper Authentication | Attacker executes arbitrary flows and accesses sensitive info |
| CVE-2026-18729 | 8.8 | Improper Code Generation Control | Authenticated attacker executes arbitrary code |
| CVE-2026-18545 | 4.3 | SSRF | Authenticated attacker sends unauthorized outbound requests |
All eight affect Langflow OSS versions 1.0.0 through 1.11.1. IBM's fix is version 1.11.2, available now on PyPI. There are no published workarounds for the two critical entries — if you're running an affected version, the patch is the mitigation.
The part the CVE count doesn't tell you
Six of the 128 Langflow CVEs are in CISA's Known Exploited Vulnerabilities catalog: CVE-2025-3248, CVE-2025-34291, CVE-2026-0770, CVE-2026-33017, CVE-2026-9198, and CVE-2026-55255. That's confirmed real-world exploitation, not a score. Two of those moved fast — CVE-2026-33017 was reportedly weaponized within about 20 hours of disclosure, and CVE-2025-3248 carries a near-maximum EPSS score of 0.9999, meaning it is, in practice, being actively probed at internet scale. Neither of the two CVEs published August 28 has a known exploit or a KEV listing as of this writing.
Langflow's confirmed-exploited CVEs, in order
- CVE-2025-3248 publishedUnauthenticated RCE via /api/v1/validate/code; later added to KEV with EPSS 0.9999
- CVE-2025-34291 publishedCORS misconfiguration enabling token hijack and RCE; added to KEV
- CVE-2026-0770 publishedexec_globals code-execution flaw; added to KEV
- CVE-2026-33017 publishedUnauthenticated RCE via public flow build endpoint; added to KEV, reportedly exploited within ~20 hours
- CVE-2026-55255 publishedIDOR on /api/v1/responses; added to KEV
- CVE-2026-9198 publishedAuto-login bypass chained into code validation RCE; added to KEV
What the volume tells you, and what it doesn't
- 128 distinct CVEs mention Langflow in our index; 111 of them since March 2026 alone
- Outside researchers, not just IBM's own team, keep finding new exploitation chains
- 6 have been confirmed exploited in the wild and added to CISA's KEV catalog
- At least one of the exploited flaws was weaponized within about 20 hours of disclosure
- Every CVE in this article has a documented fix version
- That Langflow is uniquely insecure compared to other fast-moving AI frameworks
- That the August 28 batch is being exploited today
- That a 9.9 CVSS score in this batch predicts what gets attacked next
- That the monthly count is close to leveling off
If you run Langflow
- Upgrade to Langflow OSS 1.11.2 or later — it closes all eight CVEs from the August 28 batch
- Don't expose the Langflow API or UI directly to the internet; put it behind authentication and a reverse proxy at minimum
- Check specifically for the six KEV-listed CVEs against your running version, since those are the ones with confirmed exploitation
- Treat every "custom component" or code-execution feature as a code-execution surface, because that's what the CVE history says it is
- Subscribe to IBM's Langflow security advisories directly — given the release cadence, checking cve.tools once a quarter isn't enough
CVE counts and KEV status verified 2026-08-29