CVE-2026-10134

IBM Langflow OSS 1.0.0 through 1.9.3 allows an attacker to read every secret available to the Langflow process, read and modify every flow, conversation, message, file upload, and saved component in the Langflow database, can connect to internal services, abuse cloud metadata endpoints, laterally move to other tenants on the same Langflow instance, and Establish persistence by modifying the public flow's `tool_code` so normal `/api/v1/build/...` calls by any user re-execute attacker code at each build.

CVSS v3 10.0 CRITICAL

10.0^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://www.ibm.com/support/pages/node/7277559	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*

History

25 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) IBM Langflow OSS 1.0.0 hasta 1.9.3 permite a un atacante leer cada secreto disponible para el proceso de Langflow, leer y modificar cada flujo, conversación, mensaje, carga de archivo y componente guardado en la base de datos de Langflow, puede conectarse a servicios internos, abusar de puntos finales de metadatos en la nube, moverse lateralmente a otros inquilinos en la misma instancia de Langflow, y establecer persistencia modificando el ’tool_code’ del flujo público de modo que las llamadas normales a ’/API/v1/build/...’ por cualquier usuario vuelvan a ejecutar código del atacante en cada compilación.

Information

Published : 2026-06-30 20:17

Updated : 2026-10-25 21:10

NVD link : CVE-2026-10134

Mitre link : CVE-2026-10134

CVE.ORG link : CVE-2026-10134

JSON object : View

Products Affected

langflow

langflow

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2026-10134", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-10134", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-01T03:56:03.770824Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@us.ibm.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 10.0, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.9}]}, "affected": [{"source": "psirt@us.ibm.com", "affectedData": [{"cpes": ["cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:langflow_oss:1.9.3:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "Langflow OSS", "versions": [{"status": "affected", "version": "1.0.0", "versionType": "semver", "lessThanOrEqual": "1.9.3"}]}]}], "published": "2026-06-30T20:17:26.883", "references": [{"url": "https://www.ibm.com/support/pages/node/7277559", "tags": ["Vendor Advisory"], "source": "psirt@us.ibm.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@us.ibm.com", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "IBM Langflow OSS 1.0.0 through 1.9.3 allows an attacker to read every secret available to the Langflow process, read and modify every flow, conversation, message, file upload, and saved component in the Langflow database, can connect to internal services, abuse cloud metadata endpoints, laterally move to other tenants on the same Langflow instance, and Establish persistence by modifying the public flow's `tool_code` so normal `/api/v1/build/...` calls by any user re-execute attacker code at each build."}, {"lang": "es", "value": "IBM Langflow OSS 1.0.0 hasta 1.9.3 permite a un atacante leer cada secreto disponible para el proceso de Langflow, leer y modificar cada flujo, conversaci\u00f3n, mensaje, carga de archivo y componente guardado en la base de datos de Langflow, puede conectarse a servicios internos, abusar de puntos finales de metadatos en la nube, moverse lateralmente a otros inquilinos en la misma instancia de Langflow, y establecer persistencia modificando el \u2019tool_code\u2019 del flujo p\u00fablico de modo que las llamadas normales a \u2019/API/v1/build/...\u2019 por cualquier usuario vuelvan a ejecutar c\u00f3digo del atacante en cada compilaci\u00f3n."}], "lastModified": "2026-10-25T21:10:00.770", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C66FB82E-7574-434A-92AF-C36A8E16584C", "versionEndIncluding": "1.9.3", "versionStartIncluding": "1.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@us.ibm.com"}