CVE-2026-10134 - Unauthenticated Server-Side RCE via PythonCodeStructuredTool in Public Flows · CoreCVE

Back Back to CVE browser

CRITICAL

Unauthenticated Server-Side RCE via PythonCodeStructuredTool in Public Flows

Published Jun 30, 2026

10.0

CRITICAL

CVSS 3.1

EPSS 0.64%

Description

IBM Langflow OSS 1.0.0 through 1.9.3 allows an attacker to read every secret available to the Langflow process, read and modify every flow, conversation, message, file upload, and saved component in the Langflow database, can connect to internal services, abuse cloud metadata endpoints, laterally move to other tenants on the same Langflow instance, and Establish persistence by modifying the public flow's `tool_code` so normal `/api/v1/build/...` calls by any user re-execute attacker code at each build.

Affected products

Vendor IBM Product Langflow OSS Default
n/a
- Version
  1.0.0
  Status
  affected
  Constraints
  <=1.9.3

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Version	Status	Constraints
1.0.0	affected	<=1.9.3

Remediation

Vendor solution

IBM strongly recommends addressing the vulnerability now by upgrading Langflow OSS to version 1.10.0 https://pypi.org/project/langflow/

Weaknesses (1)

CWE-94

Code Injection

References (1)

https://www.ibm.com/support/pages/node/7277559
vendor-advisorypatchVendor Advisory

Link	Providers	Tags
https://www.ibm.com/support/pages/node/7277559		vendor-advisorypatchVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner ibm

Published Jun 30, 2026

Updated Jul 1, 2026

Reserved May 29, 2026

Link CVE-2026-10134

CISA Vulnrichment

Updated Jul 1, 2026

Status Analyzed

Modified Jul 2, 2026

Link CVE-2026-10134

Severity n/a

Public date n/a

Links CVE-2026-10134

Assigner n/a

Published n/a

Updated n/a

Exploited since n/a

Link n/a