PT-2026-35239 · Ibm+1 · Langflow Oss+1
CVE-2026-9135
·
Published
2026-04-26
·
Updated
2026-07-23
CVSS v3.1
9.9
Critical
| Vector | AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
IBM Langflow OSS versions 1.0.0 through 1.10.0
Description
A code injection issue exists in the Policies component's ToolGuard integration that bypasses the
allow custom components=false security control. The validation mechanism only checks the main component source code in node template["code"]["value"] but fails to validate dynamic CodeInput fields that store generated ToolGuard Python files. Authenticated users with flow creation privileges can embed malicious Python code in these unvalidated dynamic fields, which are persisted in Flow.data and executed server-side when a guarded tool is invoked through the ToolGuard runtime, leading to arbitrary Python code execution on the backend. This can be escalated through cross-tenant flow manipulation via the agentic MCP update flow component field tool, which accepts attacker-controlled user id parameters to inject code into other users' flows. The risk is increased when combined with AUTO LOGIN=true and NEW USER IS ACTIVE=true configurations.Recommendations
Update IBM Langflow OSS to a version later than 1.10.0.
Restrict access to the
update flow component field tool to prevent unauthorized flow manipulation.
Disable AUTO LOGIN and NEW USER IS ACTIVE configurations to increase authentication requirements.Fix
Code Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Langflow Oss
Langflow