by Kastro
Paper/Archive/CVE-2026-10561

CVE-2026-10561

IBM Langflow OSS — Unauthenticated Remote Code Execution in Langflow OSS PythonREPLComponent via Builtins Injection

EPSS 0.8%CVSS 10.0
critical.is priorityof 100
42
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 57.3.573 × 2011.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

IBM Langflow OSS 1.0.0 through 1.9.3 has an vulnerability due to an improper isolation of Python execution combined with an authentication bypass that allows an unauthenticated attacker to execute arbitrary code on the host system, resulting in complete compromise

Affected

ProductAffectedFixed inSource
Langflow OSS1.0.0 – 1.9.3–CNA

Scores by source

ibm (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

patchibm.com/support/pages/node/7277242