Code injection in Langflow OSS API Graph Execution Engine (CVE-2026-8056)

CVE-2026-8056 is a code injection vulnerability in the parameter filtering mechanism of Langflow OSS's API Graph Execution Engine, specifically within the `apply_tweaks()` function. Authenticated attackers can craft API requests with malicious tweak parameters to override component configurations at runtime, enabling server-side code execution with application process privileges. This can result in unauthorized code execution, data exfiltration, lateral movement, and infrastructure compromise. Affected versions: - 1.0.0-1.10.0 We recommend updating to: 1.10.1. CVSS 8.8 · our assessment: this_week Vendor advisory: https://www.ibm.com/support/pages/node/7278933 Details: https://vuln.today/cve/CVE-2026-8056