CVE-2026-10561

Langflow Python interpreter can escape code restrictions

IBM / Langflow · Langflow PythonREPLComponent

First documented disclosure · Review checkpoint

Summary

IBM describes an unauthenticated code-execution chain combining weak Python isolation with an authentication bypass in Langflow OSS.

Severity and exploitation evidence

Critical · 10.0/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed sources do not establish malicious exploitation. A published proof of concept is not evidence of a customer compromise.

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Improper isolation of Python execution, combined with an authentication bypass, can let an attacker run code on the host.

Conditions required

Network access to a vulnerable Langflow OSS deployment. IBM describes the chain as unauthenticated; the reviewed CVE record does not specify every deployment condition.

Potential impact

Server compromise, secret disclosure, and unauthorized privilege changes.

Affected versions and configurations

Langflow OSS 1.0.0 through 1.9.3, according to IBM’s CVE record.

Fix and mitigation status

IBM identifies 1.9.4 for this CVE. A separate September interpreter-hardening advisory recommends at least 1.12.3, but its mapping to this CVE is not verified.

Practical next steps

Apply IBM’s CVE-specific fix and review subsequent Langflow hardening guidance. Restrict access, disable unnecessary interpreters, and isolate untrusted execution.

Operating lesson

Test the effective execution boundary, including automatic-login defaults.

Evidence and limits

June 21 is IBM’s initial bulletin date. The September 28 GHSA describes related interpreter hardening but has no assigned CVE in the reviewed advisory; its version range and 9.9 score are not treated as corrections to this CVE’s IBM range and 10.0 score.

Sources