Executive Summary

CVE-2026-10561 is a critical vulnerability in IBM Langflow OSS versions 1.0.0 through 1.9.3 that allows unauthenticated remote code execution (RCE). It arises from improper isolation of Python execution combined with an authentication bypass.

Specifically, the PythonREPLComponent's get_globals() function attempts to restrict accessible Python globals using a whitelist but fails to block access to the builtins module. Because the exec() function in CPython automatically inserts the full builtins module if it is missing, an attacker can access dangerous functions like import, open, and eval.

Additionally, the default setting LANGFLOW_AUTO_LOGIN=true issues a superuser JWT token via an unauthenticated GET request, enabling an attacker to bypass authentication and execute arbitrary code on the host system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthenticated remote code execution leading to complete system compromise, including exfiltration of sensitive data such as LLM provider keys and access credentials for vector stores.

Such unauthorized access and potential data theft or tampering can result in violations of data protection regulations like GDPR and HIPAA, which mandate strict controls over personal and sensitive information.

Therefore, exploitation of this vulnerability could lead to non-compliance with these standards due to unauthorized disclosure, alteration, or loss of protected data.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to complete compromise of the host system running Langflow OSS.

• Arbitrary operating system command execution at the backend process privilege level, which is root in default Docker environments.
• Exfiltration of sensitive data such as LLM provider keys (e.g., OpenAI or Anthropic keys) stored in environment variables or databases.
• Theft or tampering of flow definitions used by Langflow.
• Access to credentials for vector stores like Chroma, Pinecone, or Weaviate.
• Potential persistent compromise through installation of cron jobs, backdoored files, or modification of databases.

Useful 0 Not Useful 0

Mitigation Strategies

IBM strongly recommends upgrading to Langflow OSS version 1.9.4 or later to remediate this issue.

No official workarounds are currently available.

Useful 0 Not Useful 0