IBMCVE-2026-8476
IBM Langflow OSS: remote code execution
Critical9.9CVE-2026-8476 · Published Jul 17, 2026 · updated Jul 23, 2026
IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in the disk-based caching mechanism. The AsyncDiskCache class uses Python's unsafe pickle.loads() function to deserialize cached objects from disk without validation, integrity verification, or authentication, enabling arbitrary code execution when malicious pickle payloads are processed. Attackers who can influence cached data through file system access, malicious workflow inputs, custom components, or API manipulation can achieve complete system compromise with the privileges of the Langflow server process.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Langflow OSS Product | >= 1.0.0, <= 1.10.0 | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-502
More IBM advisories
All IBM| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jul 17 | IBM Langflow OSS: insecure direct object reference | High8.1 | No fix yet |
| Jul 17 | IBM Langflow OSS: hard-coded credentials | Critical9.8 | No fix yet |
| Jul 17 | IBM Langflow OSS: remote code execution | Critical9.8 | No fix yet |
| Jul 17 | IBM Langflow OSS: privilege escalation | Critical9.9 | No fix yet |
| Jul 17 | IBM Langflow OSS: improper input validation | Critical9.9 | No fix yet |
| Jul 17 | IBM Security Verify Access: information disclosure | Medium5.3 | No fix yet |