CVE-2026-13448 — Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to mult…

CVE-2026-13448

Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints PUBLISHED

Description (CNA)

IBM Langflow OSS 1.0.0 through 1.10.1 Lanflow OSS contains an unauthenticated remote code execution vulnerability in the public flow build endpoint ( /api/v1/build_public_tmp/{flow_id}/flow ). The vulnerability stems from an incomplete denylist in the validate_public_flow_no_code_execution() function that fails to block several code-execution agent components including OpenDsStarAgent, CodeActAgentSmolagents, and CSVAgent.

Affected (CNA)

Vendor / product	Versions
IBM / Langflow OSS	affected 1.0.0 through 1.10.1

CWE

No CWE identifiers supplied.

References

https://www.ibm.com/support/pages/node/7279997

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.