CVE-2026-3357

IBM Langflow Desktop 1.6.0 through 1.8.2 Langflow could allow an authenticated user to execute arbitrary code on the system, caused by an insecure default setting which permits the deserialization of untrusted data in the FAISS component.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.ibm.com/support/pages/node/7268428	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-04-08 01:16

Updated : 2026-07-24 23:10

NVD link : CVE-2026-3357

Mitre link : CVE-2026-3357

CVE.ORG link : CVE-2026-3357

JSON object : View

Products Affected

langflow

langflow

CWE

CWE-502

Deserialization of Untrusted Data

{"id": "CVE-2026-3357", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-3357", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-08T15:41:44.331099Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@us.ibm.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "psirt@us.ibm.com", "affectedData": [{"cpes": ["cpe:2.3:a:ibm:langflow_desktop:1.6.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:langflow_desktop:1.8.2:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "Langflow Desktop", "versions": [{"status": "affected", "version": "1.6.0", "versionType": "semver", "lessThanOrEqual": "1.8.2"}]}]}], "published": "2026-04-08T01:16:41.057", "references": [{"url": "https://www.ibm.com/support/pages/node/7268428", "tags": ["Vendor Advisory"], "source": "psirt@us.ibm.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@us.ibm.com", "description": [{"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "IBM Langflow Desktop 1.6.0 through 1.8.2 Langflow could allow an authenticated user to execute arbitrary code on the system, caused by an insecure default setting which permits the deserialization of untrusted data in the FAISS component."}, {"lang": "es", "value": "IBM Langflow Desktop 1.6.0 hasta 1.8.2 Langflow podr\u00eda permitir a un usuario autenticado ejecutar c\u00f3digo arbitrario en el sistema, causado por una configuraci\u00f3n predeterminada insegura que permite la deserializaci\u00f3n de datos no confiables en el componente FAISS."}], "lastModified": "2026-07-24T23:10:00.563", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:langflow:langflow:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FB101015-F52D-4FE2-BBED-2CFC46ABF673", "versionEndExcluding": "1.8.3", "versionStartIncluding": "1.6.0"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@us.ibm.com"}