What is the CVSS score of CVE-2026-9201?

CVE-2026-9201 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of IBM Langflow OSS are affected by CVE-2026-9201?

IBM Langflow OSS versions 1.0.0-1.10.3 expose organizations to remote code execution risks through a validation bypass in their component security controls, affecting any deployment with hardening…. A patch is available.

How to fix or mitigate CVE-2026-9201?

Within 24 hours, identify all systems running IBM Langflow OSS versions 1.0.0 through 1.10.3 and determine whether hardening mode is enabled; restrict network access to Langflow instances to trusted administrative networks only and disable component upload capabilities until patching is complete. Within 7 days, deploy the vendor-released patch from IBM's security advisory to all affected Langflow instances and validate patch success through version verification and functional testing of component validation controls. Within 30 days, conduct a full forensic review of component submission logs and execution traces from the vulnerability window to identify any unauthorized component uploads or suspicious execution patterns, then establish continuous monitoring for component creation and execution events to detect future exploitation attempts.

IBM Langflow OSS CVE-2026-9201

EUVD-2026-53572 HIGH

Inadequate Encryption Strength (CWE-326)

2026-08-05 ibm

GHSA-wq52-m42w-xg45

RCE Python IBM Langflow Oss

8.8

CVSS 3.1 · Vendor: ibm

Severity by source

Vendor (ibm) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

AC raised to H because successful exploitation depends on the non-default optional hardening mode being enabled, a condition outside attacker control; all other metrics align with the reported vector.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:R/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorVendor: ibm

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 19:31 vuln.today

CVE Published

Aug 05, 2026 - 18:26 nvd

HIGH 8.8

DescriptionCVE.org

IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute arbitrary code due to a cryptographic weakness in the custom component validation mechanism. When the optional hardening mode that restricts execution to trusted component templates is enabled, the application validates component code using a truncated SHA‑256 hash. Because the hash comparison relies on only a portion of the digest, an attacker can craft malicious component code that collides with a trusted template hash and bypasses validation. Successful exploitation allows the attacker to introduce and execute unauthorized Python code within the Langflow process, defeating the intended security control and potentially leading to full compromise of the affected instance.

AnalysisAI

Remote code execution in IBM Langflow OSS (versions 1.0.0 through 1.10.3) allows authenticated attackers to execute arbitrary Python code by exploiting a cryptographic weakness (CWE-326) in the custom component validation mechanism. When the optional hardening mode is enabled - the feature intended to restrict execution to trusted component templates - the application validates submitted component code against a truncated SHA-256 digest, making it computationally feasible for an attacker to craft a malicious Python file that collides with a trusted template's hash and bypasses the validation gate entirely. No public exploit code has been identified at time of analysis; a vendor patch is available per IBM advisory, though the exact fixed version is not stated in available data.

Technical ContextAI

IBM Langflow OSS is a Python-based open-source AI workflow orchestration platform, identified in CPE as cpe:2.3:a:ibm:langflow_oss:*:*:*:*:*:*:*:*. The platform allows users to define custom Python components that extend pipeline functionality. An optional hardening mode is designed to lock down execution by validating submitted component code against a whitelist of trusted templates using a cryptographic digest. The root cause is CWE-326 (Inadequate Encryption Strength): the comparison relies on a truncated portion of a SHA-256 output rather than the full 256-bit digest. Truncating the hash reduces collision resistance proportionally - a shorter prefix dramatically increases the probability of a birthday-type collision, enabling an attacker to engineer a malicious Python file that produces the same truncated digest as a legitimate trusted template, thereby passing the validation check and receiving execution authorization.

RemediationAI

Apply the vendor-released patch per IBM advisory https://www.ibm.com/support/pages/node/7282646. The exact fixed version number is not stated in the available advisory data and must be confirmed directly from the IBM support page before upgrading. As an interim compensating control where immediate patching is not feasible, restrict authenticated access to the Langflow instance to a tightly controlled set of trusted internal identities, reducing the attacker pool from any low-privilege user to a more governed identity set - note this does not eliminate the vulnerability but substantially raises the bar. Administrators may also audit custom component submission logs for recently added or unexpected components as a detection measure. Temporarily disabling the hardening mode is not recommended as a workaround, as doing so removes the component-level execution restriction entirely and trades a bypass risk for an open execution risk.