Paper/Archive/CVE-2026-8635

CVE-2026-8635

IBM Langflow OSS — Arbitrary Code Execution in Python Interpreter Component

CVSS 9.9 (CNA)9.9 / 10 × 3029.7 Not in CISA KEV+300.0 EPSS percentile 48.4.484 × 209.7 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated users to escalate privileges to superuser by directly manipulating the database, execute arbitrary system commands, and achieve full system compromise with Langflow service permissions.

Affected

ProductAffectedFixed inSource

Langflow OSS1.0.0 – 1.10.0–CNA

Scores by source

ibm (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

patchibm.com/support/pages/node/7278925