IBM Langflow CVE-2026-8476

Exploitation requires the attacker to place attacker-controlled bytes into a disk cache entry that AsyncDiskCache later deserializes with pickle.loads() - concretely, one of: write access to the Langflow disk cache directory on the file system; the ability to submit malicious workflow inputs; the ability to register/run custom components; or API manipulation that feeds data into the cache. The CVSS PR:L confirms some level of privilege/access is needed (not fully anonymous), so the primary limiting factor is that the attacker must reach a code path that writes into the cache - a single-user, locally isolated Langflow install with no untrusted API access and no shared file system materially reduces exposure, whereas a multi-tenant or internet-exposed instance with authenticated but low-trust users is directly at risk. No user interaction is required (UI:N).

Signals are largely consistent and point to a genuine high priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, 9.9) indicates a network-reachable, low-complexity attack needing only low privileges, with a scope change and total confidentiality/integrity/availability loss - appropriate for a deserialization-to-RCE bug. A vendor patch exists and IBM is the reporter, which raises confidence in the root-cause analysis. The main caveat is the entry condition: exploitation requires the ability to influence cached content, so PR:N was correctly avoided (PR:L). EPSS and KEV data were not provided, and no public PoC is referenced, so real-world exploitation volume is unquantified - treat this as high-severity-with-plausible-access rather than confirmed mass exploitation. The AV:N + PR:L combination is realistic for a multi-user or API-exposed Langflow deployment but overstated for a single-user local install.

An attacker with low-privileged access to a shared or API-exposed Langflow instance submits a workflow or component whose data is written into the disk cache as a malicious pickle payload; when that cache entry is later loaded via AsyncDiskCache.pickle.loads(), the embedded __reduce__ gadget executes and runs the attacker's code as the Langflow server process. Alternatively, an attacker with write access to the cache directory drops a poisoned cache file directly. No public exploit is identified at time of analysis, but the technique (pickle __reduce__ RCE) is well understood and trivially weaponizable given the low attack complexity.