What is the CVSS score of CVE-2026-8635?

CVE-2026-8635 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of IBM Langflow OSS are affected by CVE-2026-8635?

IBM Langflow OSS versions 1.0.0 through 1.10.0 contain a critical flaw allowing authenticated users to elevate themselves to administrator level and run unrestricted commands on the server, resulting…. A patch is available.

How to fix or mitigate CVE-2026-8635?

Within 24 hours, identify and inventory all systems running IBM Langflow OSS versions 1.0.0 through 1.10.0, and apply the vendor-released patch immediately to all instances; if immediate patching is not possible, isolate affected systems from production networks and restrict access to the most trusted administrators only. Within 7 days, confirm patch deployment across all Langflow deployments, review system and database logs from the preceding 30 days for evidence of unauthorized privilege escalation or command execution, and revoke access for any suspicious accounts. Within 30 days, perform a comprehensive security assessment of the patched environment, enforce principle-of-least-privilege controls on the Langflow service account, and establish real-time monitoring for privilege escalation attempts.

IBM Langflow OSS CVE-2026-8635

EUVD-2026-45270 CRITICAL

Code Injection (CWE-94)

2026-07-17 ibm

GHSA-xxqg-9cxv-cq9v

RCE IBM Code Injection Langflow Oss

9.9

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network-reachable service exploitable by any authenticated user (PR:L), no interaction, and DB-manipulation-to-RCE breaks out of the app context (S:C) with full confidentiality, integrity, and availability loss.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 17, 2026 - 19:45 vuln.today

CVE Published

Jul 17, 2026 - 19:02 cve.org

CRITICAL 9.9

DescriptionCVE.org

IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated users to escalate privileges to superuser by directly manipulating the database, execute arbitrary system commands, and achieve full system compromise with Langflow service permissions.

AnalysisAI

Privilege escalation to remote code execution in IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated user to elevate their account to superuser by directly manipulating the underlying database, then execute arbitrary system commands and achieve full compromise of the host running the Langflow service. The flaw (CWE-94, code injection) carries a critical CVSS 9.9 with a scope change, meaning code runs with the Langflow service account's permissions beyond the vulnerable component. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but a vendor patch is available.

Technical ContextAI

Langflow OSS is an open-source, Python-based low-code framework for visually building LLM/AI agent workflows, where flow components can execute code and system-level operations. The CPE cpe:2.3:a:ibm:langflow_oss:*:*:*:*:*:*:*:* identifies the affected application across versions 1.0.0-1.10.0. The root cause is classified as CWE-94 (Improper Control of Generation of Code / code injection): an authenticated user can alter privilege state directly in the backing database to gain superuser role, and that elevated context permits arbitrary command execution - a classic broken-authorization-into-code-execution chain typical of workflow platforms that expose code-running components to privileged roles.

RemediationAI

Patch available per vendor advisory - apply the fixed release referenced in IBM's advisory at https://www.ibm.com/support/pages/node/7278925; the input does not include an exact fixed version number, so confirm the target build from that advisory before upgrading. As compensating controls until patched, restrict Langflow to trusted, authenticated users only and disable or tightly limit self-service account creation, since exploitation requires an authenticated (PR:L) account; place the application behind a VPN or network ACL rather than exposing it to the internet to shrink the AV:N attack surface; lock down direct access to the backing database so application-facing accounts cannot manipulate privilege/role tables; and run the Langflow service under a least-privileged, non-root service account to reduce the impact of the S:C scope change and command execution. Note the trade-offs: disabling open registration and restricting database access may break automated onboarding or integrations that rely on that access.