CVE-2026-10561: IBM Langflow OSS RCE Vulnerability

CVE-2026-10561 Overview

CVE-2026-10561 is a remote code execution vulnerability in IBM Langflow OSS versions 1.0.0 through 1.9.3. The flaw combines improper isolation of Python execution with an authentication bypass. An unauthenticated remote attacker can execute arbitrary code on the host system, resulting in complete compromise of the affected server.

Langflow is a visual framework for building agentic AI applications and workflows on top of LangChain. The vulnerability classified under [CWE-94] (Improper Control of Generation of Code) allows attackers to inject and execute Python code without credentials. IBM has acknowledged the issue through its support advisory.

Critical Impact
Unauthenticated attackers can execute arbitrary Python code on the host with full system compromise across all Langflow OSS deployments from 1.0.0 to 1.9.3.

Affected Products

IBM Langflow OSS 1.0.0 through 1.9.3
Self-hosted Langflow instances exposed on internal or public networks
Deployments embedding Langflow as a workflow backend for LangChain agents

Discovery Timeline

2026-06-22 - CVE-2026-10561 published to the National Vulnerability Database
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-10561

Vulnerability Analysis

The vulnerability stems from two compounding defects in Langflow OSS. The first is improper isolation of Python execution within the workflow engine. The second is an authentication bypass on endpoints that accept executable workflow content.

Langflow components are designed to evaluate Python expressions and code blocks supplied by authenticated workflow authors. The flawed isolation layer fails to confine this execution to a restricted sandbox. As a result, code submitted through the API runs with the privileges of the Langflow process on the host.

The authentication bypass eliminates the trust boundary that would otherwise limit code submission to authorized users. Combined, the defects expose a direct unauthenticated path to arbitrary code execution. The CWE-94 classification reflects the underlying code injection root cause.

Root Cause

Langflow exposes endpoints that compile and execute Python code derived from flow definitions. The execution backend does not enforce isolation primitives such as restricted interpreters, subprocess sandboxing, or container boundaries. Coupled with missing authentication checks on the affected routes, any network-reachable client can post crafted flow content and trigger execution.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker locates a reachable Langflow OSS instance, submits a malicious workflow or code payload through the unauthenticated endpoint, and the server evaluates the embedded Python. The payload runs in the Langflow process context, providing arbitrary command execution, credential theft, and pivoting opportunities into adjacent cloud and internal networks.

No verified public exploit code has been published. Refer to the IBM Support advisory for vendor-supplied technical details.

Detection Methods for CVE-2026-10561

Indicators of Compromise

Unexpected child processes spawned by the Langflow service account, particularly shells, python, curl, or wget invocations
Outbound network connections from the Langflow host to unfamiliar IP addresses or pastebin-like services
New or modified files in Langflow working directories, including unexpected .py scripts or cron entries
HTTP POST requests to Langflow flow execution endpoints from unauthenticated sources

Detection Strategies

Inspect Langflow access logs for unauthenticated requests against flow execution and component endpoints
Correlate process creation events on Langflow hosts with the parent Langflow Python process to surface anomalous child execution
Apply [CWE-94] code injection identification rules to API traffic carrying Python source in JSON bodies
Hunt for reverse shell patterns originating from the Langflow host using EDR telemetry and network metadata

Monitoring Recommendations

Enable verbose request logging on Langflow and forward logs to a centralized SIEM for retention and search
Monitor for outbound connections from Langflow hosts to non-approved destinations and alert on first-seen domains
Track file integrity on the Langflow installation directory and any mounted workflow storage
Baseline normal CPU and memory profiles for the Langflow process and alert on sustained deviations indicative of crypto-mining or persistent payloads

How to Mitigate CVE-2026-10561

Immediate Actions Required

Upgrade IBM Langflow OSS to a fixed release as referenced in the IBM Support advisory
Remove direct internet exposure of Langflow instances and place them behind authenticated reverse proxies or VPN gateways
Rotate API keys, tokens, and credentials accessible to the Langflow service account, including LangChain provider keys
Audit Langflow hosts for signs of compromise before returning them to production use

Patch Information

IBM has published remediation guidance for CVE-2026-10561 on its support portal. Administrators should consult the IBM Support advisory for the fixed version, upgrade instructions, and any post-upgrade configuration steps. Versions 1.0.0 through 1.9.3 are confirmed vulnerable and must be upgraded.

Workarounds

Restrict network access to Langflow management and execution endpoints using firewall rules or service mesh policies
Enforce authentication at an upstream proxy such as an OAuth2 or mTLS gateway until the patch is applied
Run Langflow inside a hardened container with a non-root user, read-only filesystem, and egress filtering to limit blast radius
Disable or remove Langflow instances that are not actively required for production workloads

bash

# Example: restrict Langflow to localhost and front it with an authenticated reverse proxy
# 1. Bind Langflow to loopback only
export LANGFLOW_HOST=127.0.0.1
export LANGFLOW_PORT=7860

# 2. Block external access at the host firewall (Linux iptables example)
iptables -A INPUT -p tcp --dport 7860 ! -s 127.0.0.1 -j DROP

# 3. Require authentication via an upstream proxy (nginx snippet)
# location / {
#     auth_request /oauth2/auth;
#     proxy_pass http://127.0.0.1:7860;
# }