Langflow OSS: Mehrere Schwachstellen
Description
Langflow, an open-source visual interface for building LLM-based applications, has multiple vulnerabilities identified under CVE-2026-18729. These vulnerabilities relate to code injection issues as indicated by CWE-94. The affected versions include all releases prior to 1.11.2. The severity of these vulnerabilities is assessed as high. There is no information about available patches or known exploits in the wild. The vendor advisory or patch status is not provided, so remediation guidance should be sought from the official vendor sources.
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-18729 concerns multiple security weaknesses in Langflow, an open-source tool for creating applications based on large language models. The vulnerabilities are associated with CWE-94, indicating code injection flaws. The affected versions include all versions before 1.11.2. No patch or official remediation details are provided in the available data. No known exploitation in the wild has been reported. The Bundesamt für Sicherheit in der Informationstechnik is the vendor project associated with this vulnerability.
Potential Impact
The vulnerabilities could allow an attacker to perform code injection attacks, potentially leading to unauthorized code execution within the context of the Langflow application. This could compromise the integrity and security of applications built using Langflow. However, no active exploitation has been reported to date.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should monitor official Langflow and Bundesamt für Sicherheit in der Informationstechnik communications for updates and consider restricting access to vulnerable versions where possible.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-q78m-9m47-w7gw
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-18729"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6a92f7deacd9273b49e75b78
Added to database: 08/29/2026, 15:16:46 UTC
Last enriched: 09/08/2026, 02:22:42 UTC
Last updated: 10/11/2026, 18:48:17 UTC
Views: 47
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.