CVE-2026-8056

Received Received - Intake

Authenticated Parameter Override in IBM Langflow OSS

Publication date: 2026-07-17

Last updated on: 2026-07-17

Assigner: IBM Corporation

Description

IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated users to override component parameters at runtime via the API. A critical security flaw exists in the parameter filtering mechanism within the `apply_tweaks()` function.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-17

Last Modified

2026-07-17

Generated

2026-07-18

AI Q&A

2026-07-18

EPSS Evaluated

N/A

NVD

CVE-2026-8056

EUVD

EUVD-2026-45278

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	langflow_oss	From 1.0.0 (inc) to 1.10.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

IBM Langflow OSS versions 1.0.0 through 1.10.0 contain a parameter injection vulnerability in the API Graph Execution Engine's tweaks processing mechanism. Authenticated attackers with valid API credentials can bypass security controls and inject malicious parameters into flow components at runtime. This flaw allows overriding component configurations, leading to execution of attacker-controlled code on the server with application privileges.

Detection Guidance

Check Langflow OSS version with: pip show langflow or docker inspect <container> | grep langflow. If version is between 1.0.0 and 1.10.0, the system is vulnerable. Monitor API logs for unusual parameter injection attempts in the tweaks processing mechanism.

Impact Analysis

This vulnerability can lead to unauthorized code execution, data exfiltration, lateral movement within the network, and potential compromise of the underlying infrastructure. Attackers could gain control over the server with the privileges of the application process.

Compliance Impact

This vulnerability could lead to unauthorized code execution and data exfiltration, which may result in violations of GDPR (data protection) and HIPAA (health data privacy) due to unauthorized access or disclosure of sensitive information.

Mitigation Strategies

Upgrade Langflow OSS to version 1.10.1 or later immediately. Ensure API credentials are properly secured and limit access to authenticated users only. Review API logs for signs of exploitation attempts.

Hi! I’m here to help you understand CVE-2026-8056. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70