Loading vulnerability…
Code execution and authentication bypass in Langflow PythonREPLComponent
CVE-2026-10561 is a Python execution isolation vulnerability in IBM Langflow OSS PythonREPLComponent. The get_globals() function constructs a restricted execution environment using an import whitelist but fails to prevent access to unrestricted Python builtins, allowing arbitrary Python and operating-system command execution. Default auto-login behavior can provide a superuser token without credentials, making the execution flaw exploitable without authentication. Versions 1.0.0 through 1.9.3 are explicitly identified as affected. A related canonical advisory describes authenticated exploitation by users permitted to edit and run flows, also affects legacy PythonREPLToolComponent, and identifies a broader affected range before 1.10.1.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits arbitrary code execution with the Langflow backend process's privileges, potentially including root in default Docker deployments. Attackers can steal LLM provider keys and vector-store credentials, read or modify application data and configuration, steal or tamper with flow definitions, and modify the database to elevate application accounts to superuser. Persistent host compromise is possible. Authentication requirements differ between the unauthenticated auto-login exploit chain and the authenticated flow-execution scenario.
If you can’t patch tonight, do this now.
Restrict network access and run Langflow as an unprivileged user with least-privilege database credentials. Do not rely on allow_custom_components=False alone on vulnerable versions because interpreter components did not enforce that policy. On patched deployments, disable interpreter execution using LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false or LANGFLOW_BLOCK_CODE_INTERPRETER_COMPONENTS=true. Where untrusted code execution is required, configure LANGFLOW_SANDBOX_BACKEND for microVM isolation. Review activity for compromise and rotate exposed secrets. The IBM bulletin lists no workaround for the original vulnerability.
Patch, then assume compromise.
Upgrade Langflow and related packages to version 1.12.3 or later for the complete hardening series. Fixed-version guidance differs: the IBM bulletin identifies 1.9.4, while the canonical advisory and package-check guidance identify 1.10.1 as the core fix. Confirm the applicable package and advisory rather than assuming 1.9.4 covers the broader interpreter weaknesses. The newer fixes include restricted builtins, AST safety validation, fail-closed server-policy enforcement, allow-listed module proxies, and optional microVM isolation.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
17 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.