CVE-2026-9196
Received Received - Intake

Authenticated Code Execution in IBM Langflow OSS

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: IBM Corporation

Description
IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute unintended code during Agentic Assistant validation due to improper handling of LLM‑generated components. The application executes model‑generated Python code in the backend during validation prior to user approval, which may allow an attacker to trigger side effects such as outbound network access, file system interaction, or data exfiltration with the privileges of the Langflow backend process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-9196
EUVD
EUVD-2026-53574

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ibm langflow From 1.0.0 (inc) to 1.10.3 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in IBM Langflow OSS 1.0.0 through 1.10.3 allows an authenticated attacker to execute unintended code during Agentic Assistant validation. The issue occurs because the application runs model-generated Python code in the backend before user approval, potentially enabling attackers to perform actions like network access, file system interaction, or data theft with the backend process privileges.

Detection Guidance

Detecting this vulnerability requires checking for unauthorized code execution or suspicious network activity from the Langflow backend process. Monitor logs for unexpected Python code execution or outbound connections initiated by the application. Review file system interactions and data exfiltration attempts.

Impact Analysis

If exploited, this vulnerability could allow attackers to access sensitive data, modify files, or exfiltrate information with the same permissions as the Langflow backend process. This could lead to data breaches, unauthorized system changes, or further network compromise depending on the backend's privileges.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, or other regulations by enabling unauthorized data access, modification, or exfiltration. Organizations using affected versions may face legal penalties, reputational damage, and increased scrutiny for failing to protect sensitive data adequately.

Mitigation Strategies

Upgrade IBM Langflow OSS to a version beyond 1.10.3 to address the improper code validation. Disable automatic execution of model-generated Python code in the backend until patched. Restrict backend process privileges to minimize potential impact from unauthorized code execution.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-9196. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart