Veille CVE

Semaine du 14 septembre au 20 septembre 2026

6 CVE

Critique 1 Élevée 0 Moyenne 5 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « IBM Langflow OSS » ✕
  1. CVE-2026-12944 9.6 Critique

    IBM Langflow OSS

    IBM Langflow OSS 1.0.0 through 1.10.0 can allow attackers to execute arbitrary Python code with root privileges (UID=0) on the Langflow server by submitting components containing socket or urllib imports. This enables: (1) AWS credential theft via IMDSv1 SSRF with full IAM role permissions, (2) arbitrary file exfiltration from the container filesystem, and (3) lateral movement to internal services (PostgreSQL, Redis) within the Docker network. The scanner incorrectly returns "validated": true, providing a false security signal.

  2. CVE-2026-12767 6.5 Moyenne

    IBM Langflow OSS

    IBM Langflow OSS 1.0.0 through 1.11.5 is vulnerable to server-side request forgery (SSRF). This may allow an unauthenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

  3. CVE-2026-12766 5.4 Moyenne

    IBM Langflow OSS

    IBM Langflow OSS 1.0.0 through 1.11.2 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

  4. CVE-2026-12765 6.5 Moyenne

    IBM Langflow OSS

    IBM Langflow OSS 1.0.0 through 1.10.2 is vulnerable to server-side request forgery (SSRF). This may allow an unauthenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

  5. CVE-2026-12763 4.2 Moyenne

    IBM Langflow OSS

    IBM Langflow OSS 1.0.0 through 1.11.5 could allow an authenticated attacker to access another user's MCP server context due to improper cache key isolation in the MCP Tools component.

  6. CVE-2026-17628 5.4 Moyenne

    IBM Langflow OSS

    IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to change the password of an account due to improper authentication.