What is the CVSS score of EUVD-2026-53578?

EUVD-2026-53578 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of IBM Langflow OSS are affected by EUVD-2026-53578?

IBM Langflow OSS versions 1.0.0 through 1.10.3 contain a critical remote code execution vulnerability that allows any authenticated user to execute arbitrary code on affected systems.. A patch is available.

How to fix or mitigate EUVD-2026-53578?

Within 24 hours, conduct an inventory scan to identify all IBM Langflow OSS instances in your environment and document which versions are deployed; apply network segmentation or access restrictions to limit exposure. Within 7 days, apply the vendor-released patch to upgrade all instances to a patched version; schedule coordinated maintenance windows with application owners to minimize disruption. Within 30 days, verify patch deployment across all systems through automated version attestation, review authentication logs for anomalous access patterns during the vulnerability window, and update your vulnerability registry with closure evidence.

IBM Langflow OSS EUVD-2026-53578

| CVE-2026-17624 HIGH

Code Injection (CWE-94)

2026-08-05 ibm

GHSA-mqwf-65qp-wvg5

IBM RCE Code Injection Langflow Oss

8.8

CVSS 3.1 · NVD

Severity by source

Vendor (ibm) PRIMARY

HIGH

qualitative

NVD

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable with low complexity; PR:L confirmed because any authenticated user can trigger the import path; full C/I/A impact from arbitrary code execution.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (ibm).

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 06, 2026 - 19:43 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 06, 2026 - 19:37 vuln.today

cvss_changed

CVSS changed

Aug 06, 2026 - 19:37 NVD

8.5 (HIGH) 8.8 (HIGH)

Analysis Generated

Aug 05, 2026 - 19:34 vuln.today

CVE Published

Aug 05, 2026 - 18:34 nvd

HIGH 8.5

DescriptionNVD

IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of module imports.

AnalysisAI

Remote code execution in IBM Langflow OSS 1.0.0 through 1.10.3 is achievable by any authenticated attacker due to improper validation of module imports, classified under CWE-94 (Code Injection). The CVSS 8.8 score reflects full confidentiality, integrity, and availability impact with no user interaction required beyond low-privilege authentication. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Obtain low-privilege Langflow credentials

Delivery

Craft malicious module import payload

Exploit

Submit payload via Langflow API or UI

Execution

Server processes unvalidated module import

Persist

Python runtime executes attacker-controlled code

Impact

Full system compromise achieved

Access

Obtain low-privilege Langflow credentials

Delivery

Craft malicious module import payload

Exploit

Submit payload via Langflow API or UI

Execution

Server processes unvalidated module import

Persist

Python runtime executes attacker-controlled code

Impact

Full system compromise achieved

Vulnerability AssessmentAI

Exploitation	Exploitation requires the attacker to hold a valid, authenticated low-privilege account on the IBM Langflow OSS instance (PR:L per CVSS vector). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects high real-world severity: network-reachable, low attack complexity, requiring only low-privilege authentication with no user interaction. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An authenticated attacker with any valid Langflow user account submits a crafted workflow component or API request that specifies a malicious or unexpected Python module path in the import field. The server processes the import without sufficient validation, causing the Python runtime to load and execute the attacker-controlled code with the privileges of the Langflow server process. …
Remediation	Upgrade IBM Langflow OSS to a version beyond 1.10.3, per the vendor patch available at https://www.ibm.com/support/pages/node/7282646. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, conduct an inventory scan to identify all IBM Langflow OSS instances in your environment and document which versions are deployed; apply network segmentation or access restrictions to limit exposure. …

Threat intelligence, references, and detailed analysis are available after sign-in.