EUVD-2026-53572
GHSA-wq52-m42w-xg45
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AC raised to H because successful exploitation depends on the non-default optional hardening mode being enabled, a condition outside attacker control; all other metrics align with the reported vector.
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute arbitrary code due to a cryptographic weakness in the custom component validation mechanism. When the optional hardening mode that restricts execution to trusted component templates is enabled, the application validates component code using a truncated SHA‑256 hash. Because the hash comparison relies on only a portion of the digest, an attacker can craft malicious component code that collides with a trusted template hash and bypasses validation. Successful exploitation allows the attacker to introduce and execute unauthorized Python code within the Langflow process, defeating the intended security control and potentially leading to full compromise of the affected instance.
AnalysisAI
Remote code execution in IBM Langflow OSS (versions 1.0.0 through 1.10.3) allows authenticated attackers to execute arbitrary Python code by exploiting a cryptographic weakness (CWE-326) in the custom component validation mechanism. When the optional hardening mode is enabled - the feature intended to restrict execution to trusted component templates - the application validates submitted component code against a truncated SHA-256 digest, making it computationally feasible for an attacker to craft a malicious Python file that collides with a trusted template's hash and bypasses the validation gate entirely. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two specific conditions must both be true for exploitation: (1) the target Langflow instance must have the optional hardening mode explicitly enabled - this is not the default configuration, so deployments running with defaults are not exposed to this specific validation bypass; and (2) the attacker must hold a valid authenticated session with at least low-privilege access (PR:L per CVSS vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a network-accessible, low-complexity attack requiring only low-privilege authenticated access with full confidentiality, integrity, and availability impact on the affected instance. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated Langflow user - for example, a compromised low-privilege account or a malicious insider - identifies a trusted Python component template registered in the hardening mode allowlist and iterates code variations to find a payload whose truncated SHA-256 hash collides with the trusted template's digest. The attacker submits this crafted malicious component through the normal Langflow interface; because the truncated hash matches the expected value, the hardening-mode validation passes and the attacker's arbitrary Python code executes within the Langflow server process. … |
| Remediation | Apply the vendor-released patch per IBM advisory https://www.ibm.com/support/pages/node/7282646. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running IBM Langflow OSS versions 1.0.0 through 1.10.3 and determine whether hardening mode is enabled; restrict network access to Langflow instances to trusted administrative networks only and disable component upload capabilities until patching is complete. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Cross-user flow execution in Langflow (< 1.9.1) lets any authenticated API-key holder run another user's flow by passing
Same weakness CWE-326 – Inadequate Encryption Strength
View allShare
External POC / Exploit Code
Leaving vuln.today