What is the CVSS score of CVE-2026-8476?

CVE-2026-8476 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of IBM Langflow are affected by CVE-2026-8476?

IBM Langflow OSS versions 1.0.0 through 1.10.0 contain a critical unauthenticated remote code execution vulnerability in the AsyncDiskCache component that allows attackers to achieve complete server…. A patch is available.

How to fix or mitigate CVE-2026-8476?

Within 24 hours, identify and inventory all systems running IBM Langflow OSS versions 1.0.0-1.10.0 across production and non-production environments; immediately restrict network access to affected instances or take them offline if patching cannot be completed within this window. Within 7 days, apply the vendor-released patch to all identified Langflow instances, prioritizing production systems and validating the patched version in staging before production rollout. Within 30 days, conduct a forensic review of access logs, cached data, and system activity on affected instances to identify signs of compromise, verify dependent systems remain secure, and update patch management processes to reduce time-to-patch for critical vulnerabilities.

IBM Langflow CVE-2026-8476

EUVD-2026-45276 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-07-17 ibm

GHSA-r5mm-2qch-fmmr

RCE Python Deserialization IBM Langflow Oss

9.9

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network-reachable API with low-privilege access feeding the cache justifies AV:N/AC:L/PR:L; pickle RCE escaping the app to the host process supports S:C and full C/I/A loss.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 17, 2026 - 19:47 vuln.today

CVE Published

Jul 17, 2026 - 19:11 cve.org

CRITICAL 9.9

DescriptionCVE.org

IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in the disk-based caching mechanism. The AsyncDiskCache class uses Python's unsafe pickle.loads() function to deserialize cached objects from disk without validation, integrity verification, or authentication, enabling arbitrary code execution when malicious pickle payloads are processed. Attackers who can influence cached data through file system access, malicious workflow inputs, custom components, or API manipulation can achieve complete system compromise with the privileges of the Langflow server process.

Articles & Coverage 1

News Critical RCE in IBM Langflow OSS via Unsafe Pickle Deserialization - CVE-2026-8476 Jul 18, 2026

AnalysisAI

Remote code execution in IBM Langflow OSS 1.0.0 through 1.10.0 allows attackers to run arbitrary code by planting a malicious pickle payload that the AsyncDiskCache deserializes with unauthenticated pickle.loads(). Any actor able to influence cached data - via file system access, crafted workflow inputs, custom components, or API manipulation - gains full compromise at the privilege of the Langflow server process. Rated CVSS 9.9 and reported by IBM with a vendor patch available; no public exploit identified at time of analysis.

Technical ContextAI

Langflow is a Python-based visual framework for building LLM/agent workflows. The flaw sits in its disk-based caching layer: the AsyncDiskCache class serializes and retrieves cached objects using Python's pickle module, and reads them back with pickle.loads() without any integrity check, signature verification, or type validation. This is a textbook CWE-502 (Deserialization of Untrusted Data) issue - pickle's opcode stream can invoke arbitrary callables (via __reduce__), so deserializing attacker-controlled bytes is equivalent to executing attacker code. The single affected package per CPE is cpe:2.3:a:ibm:langflow_oss (all versions in the 1.0.0-1.10.0 range).

RemediationAI

Patch available per vendor advisory - upgrade to the fixed IBM Langflow OSS release identified in IBM's advisory at https://www.ibm.com/support/pages/node/7278922 (an exact fixed version number was not included in the provided data, so confirm it there before deploying). Until patched, restrict who can reach and write to Langflow: run the disk cache directory on storage writable only by the server process and enforce strict OS file permissions so no other user or workflow can drop crafted cache files; place the Langflow API behind authentication and network controls so untrusted users cannot submit workflows, custom components, or API calls that flow into the cache; and consider disabling or clearing disk-based caching if operationally acceptable (trade-off: reduced performance and loss of cache persistence). These controls narrow, but do not eliminate, the paths the description lists (file system access, malicious workflow inputs, custom components, API manipulation).