CVE-2026-9135 Overview
CVE-2026-9135 is a code injection vulnerability [CWE-94] affecting IBM Langflow OSS versions 1.0.0 through 1.10.0, including Langflow releases up to 1.9.2 at commit 94981c443d4918517b9e8163d70fc598dc33a32d. The flaw resides in the Policies component's ToolGuard integration and bypasses the allow_custom_components=false security control. Authenticated users with flow creation privileges can achieve arbitrary Python code execution on the backend by embedding malicious code in unvalidated dynamic CodeInput fields. The issue can be escalated across tenants through the agentic MCP update_flow_component_field tool, which accepts attacker-controlled user_id parameters.
Critical Impact
Authenticated attackers can execute arbitrary Python code server-side, pivot across tenants, and fully compromise the Langflow backend when combined with AUTO_LOGIN=true and NEW_USER_IS_ACTIVE=true misconfigurations.
Affected Products
- Langflow Langflow versions 1.0.0 through 1.10.0 (up to commit 94981c443d4918517b9e8163d70fc598dc33a32d)
- Deployments on Apple macOS
- Deployments on Linux and Microsoft Windows hosts
Discovery Timeline
- 2026-07-17 - CVE-2026-9135 published to the National Vulnerability Database (NVD)
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-9135
Vulnerability Analysis
The vulnerability stems from incomplete input validation in Langflow's custom-component security control. The allow_custom_components=false setting is intended to prevent authenticated users from executing arbitrary Python inside flow components. Validation only inspects the main component source stored at node_template["code"]["value"]. It does not inspect additional dynamic CodeInput fields that hold generated ToolGuard Python files.
Attackers place malicious Python inside these unvalidated dynamic fields. The payload is persisted in Flow.data alongside legitimate flow content. When a guarded tool is later invoked, the ToolGuard runtime loads and executes the attacker-supplied code on the server. This yields arbitrary code execution under the Langflow process identity, defeating the custom-component restriction entirely.
The impact is expanded by the agentic MCP interface. The update_flow_component_field tool accepts an attacker-controlled user_id parameter, allowing cross-tenant flow modification. An attacker can inject payloads into victim users' flows and wait for those flows to run. Public flows combined with AUTO_LOGIN=true and NEW_USER_IS_ACTIVE=true reduce the authentication barrier further.
Root Cause
The validator enforces a narrow allowlist by inspecting only one field path. Dynamic CodeInput fields introduced by ToolGuard components are outside that path and are never sanitized before persistence or execution.
Attack Vector
Exploitation requires network access to the Langflow API and an authenticated session with flow creation rights. The attacker crafts or edits a flow containing a ToolGuard component, injects Python into a dynamic CodeInput field, and triggers the guarded tool. Cross-tenant escalation uses the MCP update_flow_component_field tool with a spoofed user_id. Refer to the IBM Support Page for vendor details.
Detection Methods for CVE-2026-9135
Indicators of Compromise
- Unexpected Python source content stored in dynamic CodeInput fields of Flow.data for ToolGuard components
- Invocations of the MCP update_flow_component_field tool where the user_id parameter does not match the authenticated session user
- Child processes spawned by the Langflow backend process that execute shell commands, network utilities, or credential-access tooling
Detection Strategies
- Audit persisted flow definitions for Python constructs such as import os, subprocess, eval, or exec inside ToolGuard CodeInput fields
- Correlate ToolGuard runtime executions with the identity that last modified the flow to surface cross-tenant tampering
- Alert on Langflow API calls to update_flow_component_field originating from low-privilege accounts or anonymous sessions when AUTO_LOGIN=true
Monitoring Recommendations
- Enable verbose audit logging on flow create, update, and execute events, including the acting user_id and target flow owner
- Monitor outbound network connections from the Langflow host for anomalous destinations after flow execution
- Track process ancestry from the Langflow Python interpreter and flag execution of interactive shells or package managers
How to Mitigate CVE-2026-9135
Immediate Actions Required
- Upgrade Langflow beyond commit 94981c443d4918517b9e8163d70fc598dc33a32d once a fixed release is published by the vendor
- Set AUTO_LOGIN=false and NEW_USER_IS_ACTIVE=false in the Langflow environment configuration
- Restrict flow creation privileges to trusted users and disable public flow sharing where not required
- Isolate the Langflow backend in a segmented network with strict egress controls
Patch Information
IBM has published guidance for this vulnerability. Consult the IBM Support Page for the authoritative advisory, fixed version details, and upgrade instructions.
Workarounds
- Disable the ToolGuard integration and any flows that rely on dynamic CodeInput fields until a patched release is deployed
- Block or gate the MCP update_flow_component_field tool at the API gateway and reject requests where user_id does not match the authenticated principal
- Run the Langflow process as a low-privilege service account inside a container with a read-only filesystem to limit post-exploitation impact
# Configuration example: disable auto-login and inactive user auto-activation
export LANGFLOW_AUTO_LOGIN=false
export LANGFLOW_NEW_USER_IS_ACTIVE=false
export LANGFLOW_SUPERUSER_ONLY_FLOW_CREATION=true
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
