CVE-2026-10134 PUBLISHED

Unauthenticated Server-Side RCE via PythonCodeStructuredTool in Public Flows

Assigner: ibm
Reserved: 29.05.2026 Published: 30.06.2026 Updated: 01.07.2026

IBM Langflow OSS 1.0.0 through 1.9.3 allows an attacker to read every secret available to the Langflow process, read and modify every flow, conversation, message, file upload, and saved component in the Langflow database, can connect to internal services, abuse cloud metadata endpoints, laterally move to other tenants on the same Langflow instance, and Establish persistence by modifying the public flow's tool_code so normal /api/v1/build/... calls by any user re-execute attacker code at each build.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS Score: 10

Product Status

Vendor IBM
Product Langflow OSS
Versions
  • affected from 1.0.0 to 1.9.3 (incl.)

Solutions

IBM strongly recommends addressing the vulnerability now by upgrading Langflow OSS to version 1.10.0 https://pypi.org/project/langflow/

References

Problem Types

  • CWE-94 Improper Control of Generation of Code ('Code Injection') CWE