Executive brief
IBM Langflow OSS, a tool used for building AI workflows, contains a critical security flaw in how it handles temporary data storage. An attacker can exploit this to run unauthorized commands on the server, potentially leading to a full system takeover and access to sensitive AI models or data. This vulnerability affects versions 1.0.0 through 1.10.0 and requires an immediate update to protect operations.
Technical details
A deserialization vulnerability (CWE-502) exists in the AsyncDiskCache class of IBM Langflow OSS. The component uses Python's unsafe pickle.loads() function to process cached objects from disk without performing validation, integrity verification, or authentication. An attacker with the ability to influence cached data—via file system access, malicious workflow inputs, custom components, or API manipulation—can inject a malicious pickle payload. When the server subsequently deserializes this payload, it executes arbitrary code with the privileges of the Langflow server process. The vulnerability is addressed in version 1.10.1.
Affected products
- IBM Langflow OSS 1.0.0 - 1.10.0
Timeline
- 2026-07-02: disclosed: Initial publication of the security bulletin by IBM
- 2026-07-17: advisory: NVD publication date