# IBM's Langflow Scanner Said Validated. The CVE Is 9.6 Anyway. > IBM assigned CVE-2026-12944 a 9.6 for Langflow OSS 1.0.0 through 1.10.0. An authenticated user could submit a flow component the scanner marked validated while still running network code as root. IBM's fix for that row is 1.10.1. Take 1.10.3 for CVE-2026-17628, the password-reset miss on 1.0.0 through 1.10.2. No confirmed exploitation yet. Source: https://hackerlogs.com/blog/langflow-cve-2026-12944 Published: 2026-09-16 ## Key takeaways - CVE-2026-12944 is authenticated, CVSS 9.6, CWE-918. IBM: Langflow OSS 1.0.0 through 1.10.0. The scanner returned validated while network standard-library imports still ran as UID 0. - IBM's own bulletin for 12944 says upgrade to 1.10.1. The companion password-reset row, CVE-2026-17628, needs 1.10.3. Take the later build. - SecurityOnline wrote it up on 16 September. That is the Google-searchable ticket. IBM has not called either CVE exploited. - This is not CVE-2026-0768, the unauthenticated Langflow RCE VulnCheck and CSA watched being used to steal OpenAI and AWS keys in late August. - A green validated badge on an agent-built component is not a sandbox. Treat the scanner as a blocklist, then assume it is incomplete. US Google Trends on 16 September were still Steinem, football, and ChatGPT. The searchable operator ticket is [CVE-2026-12944](https://www.ibm.com/support/pages/security-bulletin-incomplete-security-scanner-blocklist-enables-network-based-code-execution-0). [SecurityOnline](https://securityonline.info/langflow-ssrf-flaw-cve-2026-12944/) wrote it up this morning. IBM's score is 9.6. The scanner on Langflow OSS told the operator the component was validated. GitLab's KEV clock ran out yesterday. This is a different product and a different class: an authenticated miss inside an agent builder, not an unauthenticated file read. Authenticated component submission, scanner false-pass, code as UID 0. Critical because the box holds the keys the flows use, not because IBM has seen it in the wild. Three panels for Langflow CVE-2026-12944: a scanner that returned validated on network imports, IBM's 9.6 authenticated miss on 1.0.0 through 1.10.0, and the 1.10.3 upgrade that also closes the password-reset row. ## What IBM actually patched. IBM's bulletin, first dated 2 July and assigned CVE-2026-12944 later, is a blocklist gap in the Langflow component scanner. The scanner already refused subprocess. It did not refuse the network standard library. An authenticated user could submit a component that still ran on the server during validation. The process returned a validated flag anyway. IBM's description is SSRF and more. The CVSS vector is 9.6 with changed scope: confidentiality and integrity high, availability none, privileges low. The process runs as UID 0. IBM lists cloud-metadata credential theft, file read from the container, and a path to services on the same Docker network. Reporter: KIM MINJUN. We are not reprinting the component that proves it. The operator fact is enough: if an authenticated user can add a component, a green validated badge is not a sandbox. Affected builds are Langflow OSS 1.0.0 through 1.10.0. IBM's remediation on that bulletin is 1.10.1. Take it, then keep going. > The scanner is a blocklist. IBM said so by shipping a longer one. A later GitHub completion of a related row still calls the scanner defense-in-depth, not a sandbox, and still allows high-level HTTP clients so legitimate API components work. Do not confuse a refused import with isolation. The same week's second IBM row is [CVE-2026-17628](https://www.ibm.com/support/pages/security-bulletin-langflow-affected-improper-authentication-due-missing-password-verification-password-reset-endpoint), CVSS 5.4, published 8 September. Authenticated callers could change their own password without proving the current one, including to a one-character secret. Affected through 1.10.2. IBM's fix is 1.10.3. [SecurityOnline](https://securityonline.info/langflow-ssrf-flaw-cve-2026-12944/) is right to treat 1.10.3 as the build that closes both. ## Why the 16th is the news. IBM sat on the scanner miss since July. The CVE number and the morning write-ups are what people are searching. There is no KEV row and no IBM statement of in-the-wild use for 12944 or 17628. That is the difference from [CVE-2026-0768](https://labs.cloudsecurityalliance.org/wp-content/uploads/2026/09/CSA_research_note_langflow_ai_framework_credential_harvesting_20260904-csa-styled.pdf), the unauthenticated Langflow RCE CSA and VulnCheck watched being used from 29 August to harvest Langflow tokens, OpenAI keys, and AWS keys. Twelfth exploited Langflow CVE of 2026, CSA said. Do not file 12944 under that campaign. Do file both as reasons the same host should already be off 1.10.x minus the last patch. > Langflow is where teams keep the keys the agents need. A root process on that box is a cloud-credential incident even when the CVE is authenticated and even when IBM has not seen exploitation. Rotate after the upgrade. A version bump without a key rotation is a wish. ## What this is not. It is not unauthenticated. Privileges are low, not none. It is not a stated in-the-wild campaign. It is not every visual agent builder. It is not the [GitLab commits-API file read](/blog/gitlab-cve-2026-85706) and not the [Hugging Face](/blog/openai-hugging-face-incident) eval swarm. It is also not a reason to keep 1.10.1 and call the month done. 17628 lives on 1.10.2. ## What to do. If you run self-hosted Langflow, or you own the cloud keys it holds: 1. Upgrade to 1.10.3. Confirm the about page. IBM's 12944 note stops at 1.10.1. The password-reset note does not. 2. Pull internet-facing Langflow off the public net until that build is live. Authenticated is not the same as safe when signup, SSO, or a shared service user exists. 3. Inventory flow components added or edited before the upgrade. Delete anything nobody can explain. The hole was the submit-and-validate path, not a new admin panel. 4. Rotate Langflow secrets, model-provider keys, and any IAM role the process could reach, including metadata-service credentials. CSA already documented that pattern on the older CVE. 5. Stop treating the component scanner as the control. If an agent can author a component, the control is identity, egress, and a non-root runtime, the same stack [Amodei and Kurtz](/blog/amodei-pace-the-frontier) spent the weekend arguing about from the other end. The X debate this week is a Spanish DPA filing and a CEO forecast. The Google-searchable ticket is an agent builder whose own scanner lied. Patch the builder. Then assume the keys on that host were in scope. ## Sources - [Incomplete Security Scanner Blocklist Enables Network-Based Code Execution](https://www.ibm.com/support/pages/security-bulletin-incomplete-security-scanner-blocklist-enables-network-based-code-execution-0) (2026-07-02) - [Langflow is affected by improper authentication due to missing password verification in the password reset endpoint](https://www.ibm.com/support/pages/security-bulletin-langflow-affected-improper-authentication-due-missing-password-verification-password-reset-endpoint) (2026-09-08) - [CVE-2026-12944 (CVSS 9.6): Langflow SSRF Flaw Disclosed](https://securityonline.info/langflow-ssrf-flaw-cve-2026-12944/) (2026-09-16) - [Harvest AI and Cloud Credentials](https://labs.cloudsecurityalliance.org/wp-content/uploads/2026/09/CSA_research_note_langflow_ai_framework_credential_harvesting_20260904-csa-styled.pdf) (2026-09-04)