Executive brief
IBM Langflow OSS, a tool used for building multi-agent AI applications, contains a critical vulnerability that allows users with basic access to take full control of the system. By exploiting a flaw in how the software handles custom code, an attacker can grant themselves administrator privileges, access the underlying database, and execute commands on the server. This could lead to the theft of sensitive AI models, data exposure, or a complete takeover of the infrastructure hosting the service.
Technical details
A code injection vulnerability (CWE-94) exists in the Python Interpreter component of IBM Langflow OSS versions 1.0.0 through 1.10.0. The flaw is located in the PythonREPLComponent, where insufficient sandboxing and validation of user-supplied Python code allow an authenticated attacker to execute arbitrary code. By leveraging this access, an attacker can directly manipulate the application's database to escalate their privileges to superuser status or execute system-level commands with the permissions of the Langflow service. This vulnerability is exploitable over the network by any user with valid credentials. IBM has released version 1.10.1 to remediate this issue.
Affected products
- IBM Langflow OSS 1.0.0 through 1.10.0
Timeline
- 2026-07-02: advisory: Initial publication of IBM security bulletin
- 2026-07-17: disclosed: NVD publication date
- 2026-07-17: patched: Remediation available in version 1.10.1