Loading story…
IBM disclosed five high-severity vulnerabilities in Langflow OSS affecting versions 1.0.0 through 1.10.0, including multiple paths to remote code execution, privilege escalation, and arbitrary file write. The issues are tracked as CVE-2026-9135, CVE-2026-8476, CVE-2026-8481, CVE-2026-8635, and CVE-2026-8859. Reported weaknesses include code injection through unvalidated dynamic CodeInput fields in the Policies component, unsafe pickle.loads() deserialization in the disk cache, direct execution of user-supplied Python in the /api/v1/validate/code endpoint, database manipulation that can elevate an authenticated user to superuser, and path traversal in the APIRequest component's Save to File feature via crafted Content-Disposition filenames.
Several of the flaws require only authenticated access and can lead to arbitrary Python or system command execution with the privileges of the Langflow server process, creating a path to full host compromise in some deployments. IBM released Langflow OSS 1.10.1 to address all five vulnerabilities and advised organizations to upgrade immediately; additional mitigation guidance includes reviewing file-system permissions and sanitizing or removing cached data where possible. Public reporting said no active exploitation had been confirmed at publication time.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
A later reference reports that IBM released Langflow OSS version 1.10.1 to remediate all five disclosed vulnerabilities. The same source says no active exploitation had been confirmed at the time of publication.
Five vulnerabilities affecting Langflow OSS versions 1.0.0 through 1.10.0 were published, covering code injection, unsafe deserialization, code execution via a validation endpoint, privilege escalation, and path traversal. The disclosed CVEs are CVE-2026-9135, CVE-2026-8476, CVE-2026-8481, CVE-2026-8635, and CVE-2026-8859.
The CVE record for CVE-2026-8635 says IBM PSIRT received the vulnerability on 2026-07-17. The flaw affects Langflow OSS 1.0.0 through 1.10.0 and can enable privilege escalation to superuser and arbitrary command execution.
The CVE record for CVE-2026-8481 states that IBM PSIRT received the vulnerability on 2026-07-17. The issue affects Langflow OSS 1.0.0 through 1.10.0 and allows authenticated users to execute arbitrary Python code through the code validation endpoint.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
threataft.com
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
IBM disclosed multiple severe vulnerabilities in **Langflow OSS** affecting versions `1.0.0` through `1.10.1`, including remote code execution, denial of service, path traversal, unauthorized file and vector store access, build job information disclosure, and exposed credentials through unauthenticated or insufficiently authorized API endpoints. The most prominent issue, **`CVE-2026-13446`**, is a hard-coded credentials flaw classified as **CWE-798** and scored **CVSS 9.8**, creating a network-exploitable path to compromise confidentiality, integrity, and availability. According to IBM's bulletin, the vulnerable endpoints could let attackers execute code, read arbitrary files, access secrets, modify other users' data, and cancel active builds without proper authorization. IBM advised users to upgrade Langflow OSS to **`1.10.2`** to remediate the issues, as the affected releases expose both application internals and connected external components to critical compromise.
Jul 18, 2026
IBM disclosed **CVE-2026-10561**, a critical unauthenticated remote code execution flaw in Langflow OSS affecting versions `1.0.0` through `1.9.3`. The vulnerability is rooted in improper isolation in the `PythonREPLComponent`: CPython's `exec()` restores full builtins access when the globals dictionary does not explicitly clear `__builtins__`, allowing attackers to bypass the intended import restrictions. IBM and downstream advisories rate the issue **CVSS 3.1 10.0**, noting it is remotely exploitable with low attack complexity, requires no privileges, and needs no user interaction. The flaw can be chained with Langflow's default `LANGFLOW_AUTO_LOGIN=true` behavior, which exposes the `/api/v1/auto_login` endpoint and can issue a superuser JWT without credentials, enabling unauthenticated code execution on the host. Successful exploitation could lead to arbitrary OS command execution, theft of LLM provider keys, flow definitions and vector store credentials, and persistent compromise of affected systems. IBM recommends upgrading to **Langflow OSS 1.9.4** immediately; no workaround was listed, and defenders are advised to apply vendor updates, harden access controls, and monitor for unauthorized activity.
Jul 12, 2026
Attackers are actively exploiting **CVE-2026-5027**, a high-severity path traversal vulnerability in the open-source AI application platform **Langflow**, to write files to arbitrary locations on target systems and potentially achieve remote code execution. The flaw affects the `POST /api/v2/files` endpoint, where the `filename` parameter is not properly sanitized, and exploitation is made more severe by Langflow's default unauthenticated auto-login behavior, which lets attackers obtain a valid session token with a single unauthenticated request. VulnCheck reported observed attacks writing apparent test files to victim hosts, while Tenable identified the issue and assigned it a **CVSS 8.8** score. Internet exposure increases the risk: Censys data indicates about **7,000** Langflow instances are reachable online, with the largest concentration in North America. The exploitation report also fits a broader pattern of sustained attacker interest in Langflow, with other vulnerabilities including **`CVE-2026-0770`**, **`CVE-2026-21445`**, **`CVE-2026-33017`**, and **`CVE-2025-34291`** also reported as exploited in 2026; the last has been linked in public reporting to the Iranian state-backed group **MuddyWater**. Separately, a newly disclosed flaw in **Roxy-WI** (**`CVE-2026-45556`**) shows a similar arbitrary file-write-to-RCE pattern on managed load balancers, but no public patch was available at publication.
Jun 29, 2026