Langflow OSS Multiple Remote Code Execution Vulnerabilities Advisory (CVE-2026-17624, CVE-2026-17633, CVE-2026-17632, CVE-2026-9196, CVE-2026-8182, CVE-2026-9201, CVE-2026-8478)

Vulnerability Overview Langflow OSS is affected by arbitrary code execution vulnerabilities involving component generation, validation, and custom component handling. The specific vulnerabilities are as follows: 1. CVE-2026-17624 - Description: Langflow OSS allows remote authenticated attackers to execute arbitrary code through improper verification of module imports. - CWE: CWE-94: Improper Control of Generation of Code ('Code Injection') - CVSS Base Score: 8.5 2. CVE-2026-17633 - Description: Langflow OSS allows remote authenticated attackers to execute arbitrary code via code injection. - CWE: CWE-94: Improper Control of Generation of Code ('Code Injection') - CVSS Base Score: 8.5 3. CVE-2026-17632 - Description: Langflow OSS allows remote authenticated attackers to execute arbitrary code through improper validation of Python code during AST-based security scanning. - CWE: CWE-94: Improper Control of Generation of Code ('Code Injection') - CVSS Base Score: 8.8 4. CVE-2026-9196 - Description: Langflow allows authenticated attackers to execute unexpected code through improper handling of LLM-generated components. - CWE: CWE-94: Improper Control of Generation of Code ('Code Injection') - CVSS Base Score: 8.1 5. CVE-2026-8182 - Description: Langflow OSS installation allows anyone to execute arbitrary code on the server via 2 HTTP requests. - CWE: CWE-94: Improper Control of Generation of Code ('Code Injection') - CVSS Base Score: 8.8 6. CVE-2026-9201 - Description: Langflow OSS allows authenticated attackers to execute arbitrary code via cryptographic weaknesses in the custom component verification mechanism. - CWE: CWE-326: Inadequate Encryption Strength - CVSS Base Score: 8.8 7. CVE-2026-8478 - Description: Langflow OSS allows remote attackers to inject arbitrary code through improper control of user-supplied code input. - CWE: CWE-94: Improper Control of Generation of Code ('Code Injection') - CVSS Base Score: 8.8 Affected Products Affected Product: Langflow OSS Affected Versions: 1.0.0 - 1.10.3 Remediation Recommended Fix: Upgrade to Langflow OSS version 1.11.0 or later. Related Links: Langflow OSS Release Page Additional Information Workarounds and Mitigations: None Notification for Future Security Bulletins: Subscribe to notifications to receive important product support alerts. References: - Full CVSS v3 Guide - Online Calculator v3 Disclaimer The Common Vulnerability Scoring System (CVSS) is an industry standard developed by the Forum of Incident Response and Security Teams (FIRST) to convey vulnerability severity and help determine response urgency and priority. IBM provides CVSS scores "as is" and makes no expressed or implied warranty. Customers are responsible for evaluating the impact of vulnerabilities on their actual or potential security posture. IBM periodically updates the records of components within its product portfolio but assumes no liability for vulnerabilities that do not pass the final end-of-support or warranty date.

Goal Reached Thanks to every supporter — we hit 100%!

Langflow OSS Multiple Remote Code Execution Vulnerabilities Advisory (CVE-2026-17624, CVE-2026-17633, CVE-2026-17632, CVE-2026-9196, CVE-2026-8182, CVE-2026-9201, CVE-2026-8478)