What is the CVSS score of CVE-2026-8056?

CVE-2026-8056 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Which versions of Langflow Oss are affected by CVE-2026-8056?

IBM Langflow open-source platform versions 1.0.0 through 1.10.0 contain a remote code execution vulnerability (CVE-2026-8056) that allows any authenticated user to gain full control of the hosting…. A patch is available.

How to fix or mitigate CVE-2026-8056?

Within 24 hours, inventory all systems running IBM Langflow OSS 1.0.0-1.10.0 in production and development environments, and immediately restrict network access to Langflow instances to approved users and subnets only. Within 7 days, apply the available vendor patch to all identified instances after testing in a non-production environment, then validate patch installation and confirm application functionality. Within 30 days, audit and rotate credentials for all authenticated accounts and service principals that had API access during the vulnerability window, implement network-layer access controls limiting Langflow API connections to trusted IP ranges, and establish a process for rapid patching of Langflow instances in the future.

Langflow Oss CVE-2026-8056

HIGH

Code Injection (CWE-94)

2026-07-17 ibm

Code Injection IBM RCE Langflow Oss

8.8

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

HIGH

qualitative

NVD

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (ibm).

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 17, 2026 - 19:48 vuln.today

CVE Published

Jul 17, 2026 - 19:13 cve.org

HIGH 8.8

DescriptionNVD

IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated users to override component parameters at runtime via the API. A critical security flaw exists in the parameter filtering mechanism within the apply_tweaks() function.

AnalysisAI

Remote code execution in IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated users to override arbitrary component parameters at runtime through the API, bypassing the parameter filtering logic in the apply_tweaks() function (CWE-94 code injection). Because a low-privileged authenticated account is sufficient and the impact is full compromise of confidentiality, integrity, and availability (CVSS 8.8), this maps to server-side code execution on the Langflow host. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Recommended ActionAI

Within 24 hours, inventory all systems running IBM Langflow OSS 1.0.0-1.10.0 in production and development environments, and immediately restrict network access to Langflow instances to approved users and subnets only. …

Threat intelligence, references, and detailed analysis are available after sign-in.