Vulnerability · Published Jun 30, 2026 · Assigned by ibm

CVE-2026-10134Unauthenticated Server-Side RCE via PythonCodeStructuredTool in Public Flows

Critical 10.0

In plain English

A critical-severity code injection in Langflow OSS from IBM. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.3% (higher than 84% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, public proof-of-concept code.

Severity (CVSS 3.1)10.0Critical

Exploit odds (30 days)2.3%top 16.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling2Metasploit, Public PoC

Official description

IBM Langflow OSS 1.0.0 through 1.9.3 allows an attacker to read every secret available to the Langflow process, read and modify every flow, conversation, message, file upload, and saved component in the Langflow database, can connect to internal services, abuse cloud metadata endpoints, laterally move to other tenants on the same Langflow instance, and Establish persistence by modifying the public flow's `tool_code` so normal `/api/v1/build/...` calls by any user re-execute attacker code at each build.

Affected products (as reported)

Vendor	Product	Versions
IBM	Langflow OSS	1.0.0 – through 1.9.3

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References

https://www.ibm.com/support/pages/node/7277559 vendor-advisory, patch