AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

IBMCVE-2026-17626

IBM Langflow OSS 1.0.0 through 1.10.3 Langflow

IBM

CVE-2026-17626 · Published Aug 5, 2026 · updated Aug 6, 2026

High8.8
No fix yet
IBM advisory

IBM Langflow OSS 1.0.0 through 1.10.3 Langflow could allow an authenticated attacker to read, modify, or expose sensitive host files via Docker-based MCP servers due to incomplete filtering of dangerous Docker volume-mount and device-mapping arguments.

Affected versions

PackageAffectedFixed in
Langflow OSS
Product
>= 1.0.0, <= 1.10.3No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-266

More IBM advisories

All IBM
High 7.4Aug 5IBM Langflow OSS: weak cryptographyCVE-2026-9205no fix yetHigh 8.1Aug 5IBM Langflow OSS: code injectionCVE-2026-9196no fix yetHigh 8.8Aug 5IBM Langflow OSS: code executionCVE-2026-9201no fix yetHigh 7.1Aug 5IBM Langflow OSS: information disclosureCVE-2026-9130no fix yetHigh 8.8Aug 5IBM Langflow OSS: code injectionCVE-2026-8478no fix yetHigh 7.4Aug 5IBM Langflow OSS: broken cryptographyCVE-2026-8470no fix yet