External risk intelligence

IBM Langflow OSS Python Execution and Auth Bypass Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-10561

IBM Langflow is a visual development tool for LLM applications. These platforms are commonly deployed as web-based interfaces or API services intended for user interaction, making them frequently accessible over the network or via public-facing web endpoints in standard deployments.

Code Injection

Langflow

1.0.0 to 1.9.3

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in IBM Langflow OSS, impacting versions prior to 1.9.3. This issue stems from improper isolation of Python execution combined with an authentication bypass, which could allow an unauthenticated attacker to execute arbitrary code on the host system, leading to a complete compromise. The exposed nature of this technology means it's often accessible over networks, increasing the potential for exploitation.

Code can be run remotely by attackers.
Key issue: remote code execution with no authentication.
Confirm if IBM Langflow is in use.

Attack Path

How an attacker could exploit the issue

An attacker could target IBM Langflow by leveraging an authentication bypass vulnerability to gain unauthorized access. This access allows them to trigger a flaw in how Python code is isolated, leading to the execution of arbitrary commands on the underlying system. Successful exploitation can result in a full compromise of the host.

Unauthenticated network access required.
Improper Python execution isolation.
Complete host system compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in IBM Langflow could allow an unauthenticated attacker to execute arbitrary code on the host system. This is possible when the software is accessed over a network, potentially leading to a complete compromise of the affected system.

Host system code execution.
Unauthenticated network access.
Complete system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in IBM Langflow OSS affects organizations deploying it for LLM application development. Responsibility likely falls to platform or application teams managing the Langflow instances, in coordination with security teams for risk assessment and network teams if exposed externally. The first actionable step is to inventory all Langflow deployments, verify their network exposure and business criticality, and identify the specific owner for each instance to plan remediation based on risk.

Platform or application teams should own resolution.
Verify network exposure and business criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is IBM Langflow OSS?

IBM Langflow OSS is a visual development tool designed to help users build and manage applications powered by Large Language Models (LLMs). Because it provides a graphical interface for creating complex AI workflows, it is commonly deployed as a web service or API, allowing developers to interact with LLMs through a centralized, network-accessible platform.

What does CWE-94 mean for CVE-2026-10561?

This CVE involves a weakness known as CWE-94, or Improper Control of Generation of Code. In plain terms, the software fails to properly restrict the execution of Python code. Because the system does not sufficiently isolate these processes, an attacker can manipulate the application to run their own unauthorized commands on the underlying host system.

How does an attacker trigger this vulnerability?

An attacker triggers this flaw by combining an authentication bypass with the lack of Python execution isolation. This means they do not need a valid user account or password to access the system. Simply reaching the application over the network allows them to inject and run arbitrary code. This bug is not triggered by standard, authenticated user workflows, but rather by malicious requests that exploit the bypass.

Is my deployment at risk according to Halo Surface Signal?

Halo Surface Signal labels this as a likely concern because IBM Langflow is frequently deployed as a public-facing web endpoint or network-accessible service to facilitate user and developer interaction. If your instance is reachable over a network—especially the internet—it is in a position where an unauthenticated attacker could potentially reach and compromise the host.

What should I do first to address this?

Your first step is to conduct an inventory to identify every IBM Langflow instance running within your organization. Once you have a list of deployments, determine which ones are accessible over the network. Assign ownership of these instances to the relevant platform or application teams so they can evaluate the business criticality and coordinate the necessary security updates to protect the underlying host systems.

References

www.ibm.com/support/pages/node/7277242

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.