PT-2026-36201 · Ibm · Langflow Desktop

Eran Shimony · Published 2026-04-30 · Updated 2026-04-30 · CVE-2026-6543

NVD

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

IBM Langflow Desktop 1.0.0 through 1.8.4 Langflow allows an attacker to execute arbitrary commands with the privileges of the process running Langflow. This allows reading sensitive environment variables (API keys, DB credentials), modifying files, or launching further attacks on the internal network.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-6543

Affected Products

Langflow Desktop

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-6543 · Security Note
• https://ibm.com/support/pages/node/7271092 · Patch, Vendor Advisory