Critical Unauthenticated RCE in Langflow OSS PythonREPLComponent

IBM disclosed CVE-2026-10561, a critical unauthenticated remote code execution flaw in Langflow OSS affecting versions 1.0.0 through 1.9.3. The vulnerability is rooted in improper isolation in the PythonREPLComponent: CPython's exec() restores full builtins access when the globals dictionary does not explicitly clear __builtins__, allowing attackers to bypass the intended import restrictions. IBM and downstream advisories rate the issue CVSS 3.1 10.0, noting it is remotely exploitable with low attack complexity, requires no privileges, and needs no user interaction.

The flaw can be chained with Langflow's default LANGFLOW_AUTO_LOGIN=true behavior, which exposes the /api/v1/auto_login endpoint and can issue a superuser JWT without credentials, enabling unauthenticated code execution on the host. Successful exploitation could lead to arbitrary OS command execution, theft of LLM provider keys, flow definitions and vector store credentials, and persistent compromise of affected systems. IBM recommends upgrading to Langflow OSS 1.9.4 immediately; no workaround was listed, and defenders are advised to apply vendor updates, harden access controls, and monitor for unauthorized activity.