What is the CVSS score of CVE-2026-8056?

CVE-2026-8056 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Langflow Oss are affected by CVE-2026-8056?

IBM Langflow open-source platform versions 1.0.0 through 1.10.0 contain a remote code execution vulnerability (CVE-2026-8056) that allows any authenticated user to gain full control of the hosting…. A patch is available.

How to fix or mitigate CVE-2026-8056?

Within 24 hours, inventory all systems running IBM Langflow OSS 1.0.0-1.10.0 in production and development environments, and immediately restrict network access to Langflow instances to approved users and subnets only. Within 7 days, apply the available vendor patch to all identified instances after testing in a non-production environment, then validate patch installation and confirm application functionality. Within 30 days, audit and rotate credentials for all authenticated accounts and service principals that had API access during the vulnerability window, implement network-layer access controls limiting Langflow API connections to trusted IP ranges, and establish a process for rapid patching of Langflow instances in the future.

Langflow Oss CVE-2026-8056

EUVD-2026-45278 HIGH

Code Injection (CWE-94)

2026-07-17 ibm

GHSA-j327-34qm-gmcp

RCE IBM Code Injection Langflow Oss

8.8

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (ibm) · only source for this CVE.

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 17, 2026 - 19:48 vuln.today

CVE Published

Jul 17, 2026 - 19:13 cve.org

HIGH 8.8

DescriptionCVE.org

IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated users to override component parameters at runtime via the API. A critical security flaw exists in the parameter filtering mechanism within the apply_tweaks() function.

AnalysisAI

Remote code execution in IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated users to override arbitrary component parameters at runtime through the API, bypassing the parameter filtering logic in the apply_tweaks() function (CWE-94 code injection). Because a low-privileged authenticated account is sufficient and the impact is full compromise of confidentiality, integrity, and availability (CVSS 8.8), this maps to server-side code execution on the Langflow host. There is no public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.