Fourteen CVEs, Three 9.9s, Thirteen Days After the Fix: IBM’s Langflow Bulletin — and an OAuth SSRF in ContextForge

2026-10-20 AI Vulnerabilities & CVEs by al-ice.ai Editorial

On 19 October 2026, IBM published two security bulletins against its own AI stack on the same day. The first discloses fourteen vulnerabilities in Langflow OSS, versions 1.0.0 through 1.12.4 — including three CVEs scored 9.9 and three more at 8.8, all of them paths to remote code execution on the server that runs your agents’ flows. The second discloses CVE-2026-8355, a server-side request forgery in the ContextForge MCP gateway’s OAuth registration that reaches cloud metadata endpoints. The fixes for both bulletins were already released — one thirteen days earlier, the other ninety days earlier — and at time of writing, exactly one of the fifteen identifiers has an NVD record. If your scanners consume NVD, fourteen of these vulnerabilities currently do not exist.

Langflow needs no introduction to this audience — 155,850 stars, MIT-licensed, the visual agent builder that half the industry prototypes on — but the scale of this bulletin still stands out against its history. We have covered Langflow’s MCP stdio sink pair, its code-validator RCE and a 25-flaw batch this year. This bulletin is larger than all of them, and its most consequential property is not any single defect. It is the thirteen-day gap between the release that fixed everything and the document that said so.

The fourteen, by severity

The three 9.9s share a shape: an authenticated attacker, low privileges, no user interaction, scope changed — code running where it should not. CVE-2026-107328 (CWE-94) is arbitrary code execution through improper neutralization of code in eval/exec. CVE-2026-107329 (CWE-94) is arbitrary code execution through improper control of code generation. CVE-2026-107327 (CWE-862) is arbitrary code execution through missing authorization. At 8.8: CVE-2026-110196 (CWE-862), where a low-privileged authenticated account bypasses the administrator-only restriction and executes arbitrary code by configuring a built-in code-execution component; CVE-2026-107326 (CWE-78), OS command injection; and CVE-2026-110309 (CWE-94), arbitrary commands through code generation. Below them: CVE-2026-110245 (CWE-287, 7.5) is improper authentication readable by unauthenticated attackers; CVE-2026-90991 (CWE-770, 6.5) is resource allocation without throttling; CVE-2026-110190 and CVE-2026-110244 (both CWE-22, 6.5) are path traversals reaching arbitrary files and sensitive information; CVE-2026-110200 (CWE-312, 6.5) is cleartext storage of sensitive information; CVE-2026-77817 (CWE-200, 6.5) is secret disclosure through flow and project exports; and CVE-2026-18894 (CWE-94, 6.5) lets a remote attacker trigger pre-existing stored Python component code in a public workflow, executing it under the flow owner’s runtime context — a trust-boundary bypass on the product’s public sharing surface.

The record the NVD did pick up is CVE-2026-107366 (published 2026-10-20T00:17:25Z, IBM PSIRT source, CWE-639, 8.3): three message endpoints perform no ownership verification, so any authenticated user can bulk-delete another user’s messages, overwrite message content — the bulletin’s own words include “to inject malicious prompts” — or hijack an entire conversation session by reassigning its session ID. Note the agent angle IBM states outright: this is prompt injection delivered through the platform’s own API, no model jailbreak required. And note a discrepancy we are reporting rather than resolving: the bulletin says CVE-2026-107366 was fixed in version 1.9.0 (likewise 18894 in 1.11.2 and 77817 in 1.11.5), while the IBM-authored NVD record for 107366 says affected 1.0.0 through 1.12.4. Both statements cannot be precisely true; version 1.12.5 contains all the fixes either way, so treat 1.12.5 as the floor and read the per-CVE fixed-version claims with care.

The fix shipped as bug fixes; the bulletin arrived thirteen days later

Langflow v1.12.5 was released 6 October 2026 at 20:09:17Z. The bulletin is dated 19 October. We read the full v1.12.5 release body, and it contains no security section, no CVE identifier and no severity — the RCE fixes sit under “Bug Fixes” as ordinary bullets, which we quote verbatim because the mapping to the bulletin is unmistakable: “fix(security): restrict built-in code execution to administrators” (that is CVE-2026-110196), “fix(mcp): redact server credentials from management responses”, “fix(a2a): enforce authenticated execution policy”, “fix(security): confine stored chat attachments to authorized storage”, alongside MCP session-leak and secret-redaction work. Formatted identically to a DataFrame filter fix two lines down. Current release is v1.12.6 (13 October); the bulletin names 1.12.5 as the remediation, and 1.12.6 sits above it.

The bulletin’s mitigations section deserves a close read because it concedes scope the CVE list does not. Deployments using MCP stdio must additionally set LANGFLOW_MCP_SERVER_INTERPRETER_HARDENING=true and LANGFLOW_CUSTOM_COMPONENT_ADMIN_ONLY=true — the upgrade alone does not harden that path, and the bulletin says the controls “can require changes to existing MCP server launch configurations,” which is vendor language for this may break your tools and you should do it anyway. For public workflows, the default restriction on custom components must stay in place; flipping LANGFLOW_ALLOW_PUBLIC_CUSTOM_COMPONENTS re-opens CVE-2026-18894 by configuration. And for CVE-2026-77817, upgrading stops new exports from leaking secrets — it does not scrub copies already exported, so rotate anything that ever appeared in an export. These are the sentences that separate operators who patched from operators who remediated.

The second bulletin: ContextForge CVE-2026-8355

CVE-2026-8355 (NVD published 2026-10-20T00:19:20Z, Received, IBM PSIRT source, CWE-918, no CVSS at NVD yet; IBM scores it 6.4) affects the IBM ContextForge MCP Gateway through 1.0.5. When a gateway is registered with OAuth client-credentials authentication, the caller-supplied oauth_config.token_url — along with redirect_uri and jwks_uri — was never passed through the SSRF protections that guard the gateway.url field. Any authenticated user with the gateways.create permission could point the token URL at loopback services, RFC 1918 hosts or cloud metadata endpoints (AWS IMDSv1, GCP, Azure); the gateway immediately issued an HTTP POST with form-encoded credentials, and when the response failed to parse as an OAuth token response, up to 256 characters of the internal response body came back in the HTTP 502 error message. A metadata-credential theft primitive with a built-in exfiltration channel, gated only by a permission commonly granted to the developer role.

Two facts frame it. First, the fix — v1.0.6, current is v1.0.11 — was released 21 July 2026, ninety days before the bulletin; the workaround (strip gateways.create from untrusted roles) is in the bulletin for anyone who cannot upgrade. Second, this is the second ContextForge CVE in a week: CVE-2026-53709, the hardcoded JWT secret that minted platform admins, published 13 October with its fix dating to May. One gateway, two critical trust defects, both disclosed months after remediation. MCP gateway operators should read the pair as a single finding about the product’s early defaults, not as two isolated bugs.

What to do

Upgrade Langflow to 1.12.5 or later (current 1.12.6), then apply the MCP stdio environment controls and restart, confirm public workflows still carry the default custom-component restriction, and rotate any credentials that ever appeared in flow or project exports. Upgrade ContextForge to v1.0.6 or later (current v1.0.11); if you cannot, remove gateways.create from the developer role and any role held by untrusted users today. If your Langflow instance was reachable by low-privileged users before patching, treat stored flows, shared sessions and message histories as untrusted input — three of these CVEs are specifically about one user’s content executing or appearing as another’s. None of the fifteen identifiers is in the CISA KEV catalogue (checked directly, 20 October 2026, 1,749 entries, zero hits), and no exploitation has been reported — unsurprising, given that thirteen of the fifteen have no NVD record for scanners or attackers’ tooling to key on yet.

Our verification was read-only. The CVE-2026-107366 identifier, publication timestamp of 2026-10-20T00:17:25.640Z, vulnStatus, the psirt@us.ibm.com source identifier, description, CWE-639 assignment and CVSS 3.1 vector and score were read first-hand from the NVD 2.0 API; spot checks of CVE-2026-107328 and CVE-2026-110196 returned no NVD records at time of writing, and the remaining bulletin identifiers are IBM-bulletin records only so far. All fourteen Langflow CVE descriptions, CWE assignments, CVSS 3.1 vectors and scores, the affected range of 1.0.0–1.12.4, the 1.12.5 remediation, the prior-release fix attributions, the MCP stdio and public-workflow mitigations and the 19 October 2026 initial-publication date were read first-hand from the complete IBM bulletin text, as were the CVE-2026-8355 description, CWE-918 assignment, IBM CVSS 6.4 vector, affected range, v1.0.6 remediation, workaround and the 256-character reflection detail. The absence of CVEs or a security section in the v1.12.5 release notes — and every quoted bullet — was confirmed by reading the full release body; the v1.12.5 and v1.12.6 publication timestamps and the repository metadata (155,850 stars, 10,258 forks, MIT) were read first-hand from the GitHub API, as were the ContextForge v1.0.5, v1.0.6 and v1.0.11 tags and dates. KEV status was checked directly against the published catalogue. Brave Search was used for discovery only and returned earlier Langflow bulletins and press coverage of older flaws, with no independent technical analysis of this bulletin. We installed nothing, stood up no Langflow or ContextForge instance, registered no gateway, sent no OAuth request and executed no proof of concept; no third-party request was sent beyond reading the cited public records.

Sources: