Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
IBM Langflow OSS 1.0.0 through 1.11.1 allows an authenticated attacker to execute arbitrary operating system commands in the server process by saving a flow with a crafted type field value and triggering a build of a wrapper flow that references it. This allowed privilege escalation from "authenticated flow user" to arbitrary OS-level command execution under the server process identity, bypassing the LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false policy control.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-08-29 | 3 | Exploit1General2 |
| 2026-08-31 | 1 | Disclosure1 |
Warning: Critical Remote Code Execution flaws in IBM #Langflow OSS. CVE-2026-19295, CVE-2026-19286 CVSS: 9.9, 9.8. These vulnerabilities can lead to remote code execution. #Patch #Patch #Patch
Post summary
Two critical remote code execution vulnerabilities (CVE‑2026‑19295 and CVE‑2026‑19286) have been disclosed in IBM Langflow OSS, with CVSS scores of 9.9 and 9.8, indicating a high‑risk exposure.
[CVE] CVE-2026-19295 [CRITICAL/PoC] #Langflow is affected by multiple remote code execution vulnerabilities due to... ⚠️ Recorded Exploit Available 🔗 https://exploitgrid.net/cve/CVE-2026-19295
Post summary
CVE‑2026‑19295 is a critical remote code execution vulnerability with a publicly available proof of concept and recorded exploit, but no evidence of active wild‑world exploitation or mitigation steps are reported.
🛡️ ExploitGrid Daily Threat Digest Top Vulnerabilities (CVEs) of the day CVE-2026-19295 - EXPLOIT CVE-2026-54745 CVE-2026-82222 CVE-2026-18527 CVE-2026-55565 ..🧵👇
Post summary
The digest headlines a few CVEs, noting that CVE‑2026‑19295 is an exploit, but provides no technical details, PoC, or patch information.
NewNormal Security turns the last 24 hours of CVEs into new detections, every day. 𝗗𝗮𝗶𝗹𝘆 𝗖𝗩𝗘 𝗥𝗲𝗽𝗼𝗿𝘁 — 29 Aug 2026 𝗔𝗱𝗱𝗲𝗱 to NewScan 𝘁𝗼𝗱𝗮𝘆: 📦 Outdated AI workflow builder — code execution on the server, some of it with no login at all (IBM Langflow OSS CVE-2026-19286, CVE-2026-19295, CVE-2026-18729, CVE-2026-18891, CVE-2026-18904, CVE-2026-18899, CVE-2026-19294, CVE-2026-18545) 🖥️ Admin API shipped with authentication off — anonymous superuser on the cluster: add users, rewrite ACLs, drop brokers (Redpanda CVE-2026-82266) 🔑 API hands out the app's own web UI password — along with the host's model and data paths (Stable Diffusion WebUI CVE-2026-82288) Test your stack with NewScan — free, self-hosted: https://newnormalsecurity.com/newscan?utm_source=x&utm_medium=social&utm_campaign=daily-cve #infosec #AppSec #RCE #CSO #REDTEAM
Post summary
The post announces a daily CVE report, listing newly detected CVEs and describing their technical weaknesses, but provides no PoC, exploit code, or evidence of active exploitation.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | langflow | langflow | - | - | - |