External risk intelligence

IBM Langflow OSS Remote Code Execution and Data Tampering Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-10134

IBM Langflow is a development and orchestration platform commonly deployed as a web-based service or API-driven application. Given its function as an interface for managing workflows, data flows, and integrations, it is frequently hosted in network-accessible environments, making it likely to be reachable from the internet or exposed as an external service.

Code Injection

Langflow

1.0.0 to 1.9.3

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory highlights a critical vulnerability in IBM Langflow, an open-source platform used for developing and orchestrating workflows and data flows. The flaw could allow unauthorized individuals to access sensitive information, manipulate data, and potentially compromise internal systems and other users on the same instance.

Secrets and data can be accessed and modified.
Critical for controlling sensitive information and system integrity.
Confirm exposure and understand operational risk.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by leveraging network access to interact with an exposed IBM Langflow instance. This could involve manipulating data within the Langflow database or exploiting its connection capabilities to access sensitive information and potentially move laterally within the environment, ultimately leading to code execution and persistence.

Accessible via the network.
Manipulate database contents.
Achieve code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to access and manipulate sensitive information and system resources. The attacker could read all secrets used by the Langflow process, modify all stored data including flows, conversations, messages, and file uploads, and connect to internal services. Furthermore, they could achieve lateral movement to other tenants on the same Langflow instance and establish persistence by injecting malicious code that executes with user requests.

Access to all Langflow secrets and data.
Via network, unauthenticated access.
Compromise of all tenant data and services.

Operational Fix

Recommended remediation, mitigation, and detection steps

To address this critical vulnerability in IBM Langflow, application owners and platform teams are likely responsible for identifying instances, assessing business criticality, and planning remediation. The first practical step involves locating all deployments, determining their exposure, and confirming ownership to prioritize actions.

Owner: Application or Platform Team.
Verify: Reachability and business criticality.
Action: Plan targeted remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is IBM Langflow OSS?

IBM Langflow OSS is an open-source platform designed for building, orchestrating, and managing complex AI workflows, data flows, and integrations. It provides a visual interface for developers to connect various components, process messages, and manage file uploads within a centralized environment.

What is the vulnerability in CVE-2026-10134?

This vulnerability is classified as Improper Control of Generation of Code, or CWE-94. In plain English, it means the application fails to properly restrict the execution of code provided by users. Because of this flaw, an attacker can trick the system into running unauthorized commands, leading to full control over stored data, system secrets, and backend services.

How does an attacker trigger this vulnerability?

An attacker triggers this bug by sending malicious network requests to the Langflow instance without needing any authentication. It is important to note that this is not limited to specific complex configurations; the vulnerability exists in the core way the application handles inputs. It does not require a user to be logged in or have specific permissions to execute the malicious code.

Is my IBM Langflow instance at risk?

If your instance is reachable over the network, it is at risk. Halo Surface Signal indicates that IBM Langflow is frequently deployed as a web-based or API-driven service, making it likely to be accessible from the internet. If your installation allows network connections from outside your immediate internal environment, it should be considered exposed and a priority for review.

How should I respond to this threat?

Begin by creating a comprehensive inventory of all IBM Langflow deployments within your organization. Once identified, verify which instances are reachable over the network and determine their business criticality. Coordinate with your platform teams to assess the risk to stored data and plan for the necessary updates or mitigation steps to secure the environment.

References

www.ibm.com/support/pages/node/7277559

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.