Loading vulnerability…
Unsafe Pickle Deserialization RCE in IBM Langflow OSS AsyncDiskCache
CVE-2026-8476 is a critical remote code execution vulnerability in IBM Langflow OSS affecting versions 1.0.0 through 1.10.0. The flaw is in the disk-based caching mechanism, where the AsyncDiskCache class deserializes cached objects from disk using Python's unsafe pickle.loads() without validation, integrity verification, or authentication. Because pickle deserialization can invoke attacker-controlled object reconstruction behavior, any malicious serialized payload reaching the cache can trigger arbitrary code execution during cache processing. The issue is remotely reachable in deployments where an attacker can influence cached data through workflow inputs, custom components, API manipulation, or other paths that affect cache contents.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows arbitrary code execution in the context of the Langflow server process. This can result in full compromise of the application instance and underlying host accessible to that process, including theft or modification of application data, installation of persistence mechanisms, lateral movement from the affected service, and disruption of service availability.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by preventing untrusted users or workflows from influencing cache contents, restricting use of custom components and API functionality that can write attacker-controlled data into the cache path, and tightening file system permissions around cache storage so only the minimum required service account can access it. Limit network exposure of Langflow to trusted users, monitor for anomalous cache-related behavior, and consider clearing disk cache data during incident response or before returning the service to production.
Patch, then assume compromise.
Upgrade IBM Langflow OSS to version 1.10.1 or later, which remediates the unsafe deserialization issue. In addition to upgrading, remove or sanitize existing cached data where feasible so previously written malicious serialized objects cannot be processed after restart or normal cache access. Review and reduce write access to cache storage and related application data paths, and audit application features or integrations that can influence cache contents.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.