Loading vulnerability…
Code Injection in IBM Langflow OSS ToolGuard Policies Component
CVE-2026-9135 is a code injection vulnerability in IBM Langflow OSS affecting versions 1.0.0 through 1.10.0. The flaw is in the Policies component's ToolGuard integration and allows bypass of the allow_custom_components=false security control. The validation logic inspects only the primary component source stored in node_template["code"]["value"] but does not validate dynamic CodeInput fields used to store generated ToolGuard Python files. An attacker can place malicious Python code into these unvalidated dynamic fields, where it is persisted in flow data and later executed on the server when a guarded tool is invoked through the ToolGuard runtime. The issue enables authenticated users with flow creation privileges to obtain arbitrary backend Python execution despite restrictions intended to block custom component code. The vulnerability can also be extended into cross-tenant flow manipulation through the agentic MCP update_flow_component_field capability, which accepts attacker-controlled user_id values and can be abused to inject malicious code into another user's flow.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation results in arbitrary Python code execution on the Langflow backend with the privileges of the server process. This can lead to full compromise of the application instance, including unauthorized access to data handled by the service, modification of flows and application state, execution of system commands through Python, service disruption, and potential lateral movement from the host. Because the flaw can be used for cross-tenant flow manipulation, it may also permit one tenant or user to implant malicious logic into another user's flows. In deployments with publicly accessible flows and insecure configuration choices such as AUTO_LOGIN=true and NEW_USER_IS_ACTIVE=true, the practical authentication barrier for exploitation may be reduced.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by restricting flow creation and editing privileges to trusted users only, disabling or tightly controlling publicly accessible flows, and reviewing deployment settings that weaken authentication or account activation controls, including AUTO_LOGIN and NEW_USER_IS_ACTIVE. Limit or disable use of the vulnerable ToolGuard policy path where feasible, monitor for unexpected modifications to flow data and policy-related components, and isolate Langflow instances to reduce the impact of backend code execution.
Patch, then assume compromise.
Upgrade IBM Langflow OSS to version 1.10.1 or later, which is identified as the vendor fix for this issue. In addition to upgrading, ensure that validation is applied consistently to all executable code-bearing fields, including dynamic CodeInput fields used by ToolGuard-generated artifacts, so that policy enforcement cannot be bypassed through alternate storage locations for Python code.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.