CVE-2026-8635

CRITICAL 9.9

Arbitrary Code Execution in Python Interpreter Component

CVSS Score

9.9

EPSS Score

0.0%

EPSS Percentile

0th

IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated users to escalate privileges to superuser by directly manipulating the database, execute arbitrary system commands, and achieve full system compromise with Langflow service permissions.

CWE	CWE-94
Vendor	ibm
Product	langflow oss
Published	Jul 17, 2026

Stay Ahead of the Next One

Get instant alerts for ibm langflow oss

Be the first to know when new critical vulnerabilities affecting ibm langflow oss are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

IBM / Langflow OSS

1.0.0 ≤ 1.10.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

ibm.com: https://www.ibm.com/support/pages/node/7278925

Credits

XlabAI (XlabAITeam) [email protected]