EUVD-2026-45257
GHSA-mmph-9cw2-f8r6
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Network-reachable, low-complexity code injection needing an authenticated flow-creator (PR:L); cross-tenant execution crosses a trust boundary (S:C) yielding full backend RCE (C/I/A:H).
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
2DescriptionCVE.org
IBM Langflow OSS 1.0.0 through 1.10.0 Langflow versions up to 1.9.2 (commit 94981c443d4918517b9e8163d70fc598dc33a32d) contain a code injection vulnerability in the Policies component's ToolGuard integration that bypasses the allow_custom_components=false security control. The vulnerability exists because the validation mechanism only checks the main component source code in node_template["code"]["value"] but fails to validate dynamic CodeInput fields that store generated ToolGuard Python files. Attackers can embed malicious Python code in these unvalidated dynamic fields, which are persisted in Flow.data and later executed server-side when a guarded tool is invoked through the ToolGuard runtime. This allows authenticated users with flow creation privileges to achieve arbitrary Python code execution on the backend despite custom component restrictions. The vulnerability can be escalated through cross-tenant flow manipulation via the agentic MCP update_flow_component_field tool, which accepts attacker-controlled user_id parameters, enabling attackers to inject malicious code into victim users' flows. When combined with publicly accessible flows and specific misconfigurations (AUTO_LOGIN=true, NEW_USER_IS_ACTIVE=true), the attack can be conducted with reduced authentication requirements.
Articles & Coverage 1
AnalysisAI
Arbitrary Python code execution in IBM Langflow OSS 1.0.0 through 1.10.0 (Langflow versions up to 1.9.2) allows authenticated users with flow-creation privileges to bypass the allow_custom_components=false control via the Policies component's ToolGuard integration. Because validation only inspects the main component code and ignores dynamic CodeInput fields, attackers persist malicious Python in a flow that runs server-side when a guarded tool executes. No public exploit has been identified at time of analysis, but the flaw is IBM-confirmed with a vendor patch and carries a critical 9.9 CVSS due to cross-tenant escalation through the agentic MCP update_flow_component_field tool.
Technical ContextAI
Langflow is an open-source, low-code visual builder for LLM/agent workflows that persists flow graphs (nodes and their template fields) as JSON in Flow.data and executes component Python at runtime. The root cause is CWE-94 (Improper Control of Generation of Code): the security control meant to enforce allow_custom_components=false only validates node_template["code"]["value"] - the primary component source - while the ToolGuard integration stores generated guard logic in separate dynamic CodeInput fields that are never passed through the same validation. Those unvalidated fields are serialized into Flow.data and later compiled/executed server-side by the ToolGuard runtime whenever a guarded tool is invoked. The affected package is identified by CPE cpe:2.3:a:ibm:langflow_oss:*, and the agentic MCP layer's update_flow_component_field tool compounds the issue by trusting an attacker-controlled user_id, allowing writes into other tenants' flows.
RemediationAI
Patch available per vendor advisory - apply the fixed Langflow OSS release referenced in IBM's advisory at https://www.ibm.com/support/pages/node/7278920 (an exact patched version number is not stated in the provided data and should be taken directly from that advisory rather than assumed). Until patched, reduce risk with specific compensating controls: disable or restrict the Policies/ToolGuard integration so untrusted dynamic CodeInput fields are not executed; harden authentication by setting AUTO_LOGIN=false and NEW_USER_IS_ACTIVE=false to remove the reduced-authentication path, at the cost of requiring explicit user provisioning; restrict or gate the agentic MCP update_flow_component_field tool to prevent attacker-controlled user_id writes into other tenants' flows; and avoid exposing flows publicly, accepting the usability trade-off of tighter access controls. Treat allow_custom_components=false as insufficient on unpatched versions and limit flow-creation privileges to trusted users.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today