AINewsnow

CVE-2026-12944: How a Missing Entry in Langflow's Import Blocklist Becomes Root Code Execution

This story is from 2026-09-28. It is preserved in the archive; the latest stories are on the live feed.

At a Glance Item Detail CVE ID CVE-2026-12944 Vulnerability class CWE-918 (SSRF) → authenticated server-side arbitrary code execution CVSS 3.1 9.6 (Critical) — AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N Affected IBM Langflow OSS 1.0.0 – 1.10.0 Fixed in 1.10.1 (1.10.3 if you also want the related auth bug,…

Read the full story at DEV Community — AI ↗

Timeline · 1 report

  1. 2026-09-28 00:21 · DEV Community — AI
    CVE-2026-12944: How a Missing Entry in Langflow's Import Blocklist Becomes Root Code Execution

More stories

  1. Nvidia CEO Jensen Huang resigns amid affair reports; board investigation weighs on shares — CSET Georgetown
  2. Anthropic launches Claude Fable 5.2, topping benchmarks and drawing developer comparisons — Anthropic (X)
  3. Google DeepMind launches AlphaGenome 2 to predict genetic variant effects by cell type — Google DeepMind Blog
  4. Google DeepMind's AlphaProof Code formally verifies Signal's cryptographic code in four weeks — Google DeepMind Blog
  5. Scientists use Google AI to help restore giant kelp forests — Google AI Blog
  6. AI data center boom spans China buildout, SK hynix HBM4 ramp and Poste's €600M fund — DigiTimes Asia
  7. Google Opens Pre-Orders for Gemini-Powered Intelligent Eyewear Starting at $395 — Google AI Blog
  8. Google launches Gemini Decisions API with Gemini Decision 1 model for fast closed-set choices — Google Cloud AI Blog

Get the daily brief of stories like this at 6:30 every morning →