What is the CVSS score of CVE-2026-8182?

CVE-2026-8182 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of IBM Langflow OSS are affected by CVE-2026-8182?

IBM Langflow OSS versions 1.0.0 through 1.10.3 contain a remote code execution vulnerability that enables any internet-accessible attacker to compromise affected servers through a minimal attack…. A patch is available.

How to fix or mitigate CVE-2026-8182?

Within 24 hours, identify all IBM Langflow OSS deployments running versions 1.0.0-1.10.3 and restrict network access to trusted networks only or take systems offline. Within 7 days, apply the vendor-released patch via IBM's security advisory to all affected instances and validate successful deployment. Within 30 days, implement network-level controls to prevent direct internet exposure of Langflow instances and establish monitoring to detect exploitation attempts.

IBM Langflow OSS CVE-2026-8182

EUVD-2026-53573 HIGH

Code Injection (CWE-94)

2026-08-05 ibm

GHSA-994g-w9jv-hxcv

RCE IBM Code Injection Langflow Oss

8.8

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Description explicitly states no credentials required, overriding vendor PR:L; network-reachable default install with full CIA impact confirmed.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 19:31 vuln.today

CVE Published

Aug 05, 2026 - 18:26 nvd

HIGH 8.8

DescriptionCVE.org

IBM Langflow OSS 1.0.0 through 1.10.3 installations allow anyone on the internet to execute arbitrary code on the server without any credentials via 2 HTTP requests.

AnalysisAI

Remote code execution in IBM Langflow OSS 1.0.0 through 1.10.3 allows any internet-reachable attacker to execute arbitrary server-side code using only two HTTP requests. The vulnerability is rooted in CWE-94 (Code Injection), enabling full server compromise with no user interaction. A vendor patch is available via IBM advisory, and no public exploit has been identified at time of analysis - however the trivially low attack complexity makes any internet-exposed instance an immediate remediation priority.

Technical ContextAI

IBM Langflow OSS is IBM's distribution of the Langflow AI workflow orchestration platform, used to build, deploy, and manage LLM-based pipelines and AI agent workflows. The affected CPE (cpe:2.3:a:ibm:langflow_oss:*:*:*:*:*:*:*:*) covers all releases from 1.0.0 through 1.10.3. The root cause class is CWE-94 (Improper Control of Generation of Code), where user-supplied input is interpreted or evaluated as executable code without adequate sanitization or sandboxing. In the context of an AI workflow platform, this likely involves dynamic evaluation in pipeline component definitions, custom code execution endpoints, or workflow trigger APIs - common surfaces in LLM orchestration tooling where arbitrary Python or scripting primitives are exposed by design. The two-request attack path is a strong indicator of a deliberate exploit chain - possibly a component registration or file staging step followed by a server-side code evaluation trigger - rather than a single-request memory corruption class bug.

RemediationAI

The primary remediation is to apply the vendor-released patch documented in IBM's security advisory at https://www.ibm.com/support/pages/node/7282646. The advisory should specify the exact fixed version; the available intelligence data does not include the patched version number, so the advisory must be consulted directly to confirm the upgrade target. If immediate patching is not feasible, the most effective compensating control is to remove internet exposure entirely by placing the IBM Langflow OSS instance behind a VPN or network firewall that restricts HTTP access to authorized internal addresses only - this directly eliminates the AV:N attack vector and prevents delivery of the two exploit requests. If service availability requires broader access, restrict the application's API surface to known-good IP ranges at the perimeter. Disabling or decommissioning non-critical or development instances that do not require internet exposure should be considered until the patch is applied. Note that network-layer controls are compensating, not corrective - the code injection root cause remains present in unpatched instances regardless of access restrictions.