Langflow: IBM Langflow OSS 1.0.0 through 1.10.0 Langflow versions up to 1.9.2 (commit…
Langflow
More for Langflow RSS feed for Langflow
- Severity
- Critical, CVSS 9.9
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Record
- CVE-2026-9135
- Affects
- Langflow
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- July 17, 2026
- Source last modified
- October 24, 2026
Description
IBM Langflow OSS 1.0.0 through 1.10.0 Langflow versions up to 1.9.2 (commit 94981c443d4918517b9e8163d70fc598dc33a32d) contain a code injection vulnerability in the Policies component's ToolGuard integration that bypasses the allow_custom_components=false security control. The vulnerability exists because the validation mechanism only checks the main component source code in node_template["code"]["value"] but fails to validate dynamic CodeInput fields that store generated ToolGuard Python files. Attackers can embed malicious Python code in these unvalidated dynamic fields, which are persisted in Flow.data and later executed server-side when a guarded tool is invoked through the ToolGuard runtime. This allows authenticated users with flow creation privileges to achieve arbitrary Python code execution on the backend despite custom component restrictions. The vulnerability can be escalated through cross-tenant flow manipulation via the agentic MCP update_flow_component_field tool, which accepts attacker-controlled user_id parameters, enabling attackers to inject malicious code into victim users' flows. When combined with publicly accessible flows and specific misconfigurations (AUTO_LOGIN=true, NEW_USER_IS_ACTIVE=true), the attack can be conducted with reduced authentication requirements.
Description quoted from the NVD record.
Who is affected
Langflow (also called IBM Langflow OSS) is a tool for building apps that use AI language models. This flaw affects IBM Langflow OSS versions 1.0.0 through 1.10.0, and Langflow versions up to 1.9.2. The problem is in the Policies feature that puts guardrails around tools. A logged-in user who is allowed to create flows can hide harmful code that the server later runs, even when custom components are blocked. An attacker may also be able to slip code into other users' flows. With publicly shared flows and certain sign-in settings turned on, less login access is needed. This flaw is rated Critical.
What to do
- The person who installed or runs Langflow for your organization should act on this. Check which version you use against the affected versions above.
- No fixed version is named for this flaw yet, so check the vendor advisory linked on this page for a fixed release and install it as soon as it is available.
- If an IT provider or vendor runs Langflow for you, send them this advisory and ask when the update will be done.
- Share this advisory with anyone in your organization who builds flows in Langflow, so they know about the problem.
Analysis written from the source record as of October 24, 2026 and reviewed before publishing.