What is the CVSS score of CVE-2026-7873?

CVE-2026-7873 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of IBM Langflow are affected by CVE-2026-7873?

IBM Langflow OSS versions 1.0.0-1.10.0 contain a critical vulnerability that allows any authenticated user to execute arbitrary commands on the host server and exfiltrate stored credentials.. A patch is available.

How to fix or mitigate CVE-2026-7873?

24 hours: Identify all systems running IBM Langflow OSS versions 1.0.0-1.10.0; restrict network access to vulnerable instances pending patching. 7 days: Deploy the patch version specified in IBM's security advisory to all vulnerable systems; conduct functional testing in staging environments. 30 days: Confirm patching is complete across all production Langflow instances; rotate any credentials stored in or accessed through Langflow; review audit logs for evidence of unauthorized command execution or credential access.

IBM Langflow CVE-2026-7873

EUVD-2026-40381 CRITICAL

Code Injection (CWE-94)

2026-06-30 ibm

GHSA-v798-mcc6-2m3m

Code Injection IBM RCE Langflow Oss

9.9

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network-reachable, low-complexity code injection requiring only a low-privileged account (PR:L); OS command execution breaks out of the app context (S:C) for full C/I/A loss.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 30, 2026 - 19:51 vuln.today

DescriptionCVE.org

IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated attackers to execute arbitrary OS commands and read sensitive files including credentials, enabling complete system compromise and lateral movement.

AnalysisAI

Code injection in IBM Langflow OSS versions 1.0.0 through 1.10.0 lets an authenticated user execute arbitrary operating-system commands and read sensitive files such as stored credentials, escalating from low-privileged application access to full host compromise. Rated CVSS 9.9 with a scope-changing vector, the flaw enables lateral movement once an attacker holds any valid Langflow account. No public exploit identified at time of analysis, but a vendor patch is available.

Technical ContextAI

Langflow OSS is IBM's open-source, low-code visual builder for composing LLM and agent pipelines, which by design executes user-authored flow logic. The root cause is CWE-94 (Improper Control of Generation of Code / code injection): attacker-influenced input is incorporated into code or commands that the server-side runtime then evaluates, allowing OS command execution outside the intended flow sandbox. The single affected CPE, cpe:2.3:a:ibm:langflow_oss, confirms this is the open-source Langflow distribution rather than a separately versioned hosted IBM product, and the CVSS scope change (S:C) reflects that the injected code breaks out of the application's authorization context to act on the underlying host and its files.

RemediationAI

Apply the fix referenced in IBM's advisory at https://www.ibm.com/support/pages/node/7278441 (Patch available per vendor advisory); the exact fixed version is not stated in the available data and must be taken from that page, so upgrade to the first release above 1.10.0 that IBM designates as patched. Until patched, reduce exposure by removing Langflow from public network reach and placing it behind a VPN or authenticating reverse proxy, since exploitation requires a valid account - tighten account provisioning, rotate and minimize the number of low-privileged accounts, and review who can author or run flows (trade-off: restricting flow-authoring undercuts Langflow's core function for those users). Additionally rotate any credentials or secrets stored in or reachable by the Langflow host, as the flaw permits reading sensitive files. Do not rely on these controls as a substitute for the vendor patch.