PT-2026-31055 · Faiss+1 · Faiss+1

Weblover · Published 2026-04-02 · Updated 2026-04-08 · CVE-2026-3357

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions IBM Langflow Desktop versions 1.6.0 through 1.8.2

Description IBM Langflow Desktop versions 1.6.0 through 1.8.2 may allow an authenticated user to execute arbitrary code on the system. This is due to an insecure default setting that permits the deserialization of untrusted data within the FAISS component.

Recommendations Update to a version later than 1.8.2.

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2026-05277

CVE-2026-3357

Affected Products

Faiss

Ibm Langflow Desktop

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-3357 · Security Note
• https://bdu.fstec.ru/vul/2026-05277 · Security Note
• https://twitter.com/CVEnew/status/2041711834806518225 · Twitter Post
• https://twitter.com/CyberBriefDaily/status/2041773724941312368 · Twitter Post
• https://twitter.com/cybrsecpath/status/2041777241139638284 · Twitter Post
• https://ibm.com/support/pages/node/7268428 · Patch, Vendor Advisory
• https://twitter.com/CVEarity/status/2041772606815400020 · Twitter Post
• https://twitter.com/CveFindCom/status/2041693312017485930 · Twitter Post