PT-2026-36201 · Ibm · Langflow Desktop

Eran Shimony · Published 2026-04-30 · Updated 2026-05-08 · CVE-2026-6543

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IBM Langflow Desktop versions 1.0.0 through 1.8.4

Description An issue allows an attacker to execute arbitrary commands with the privileges of the process running Langflow. This can lead to the exposure of sensitive environment variables, such as API keys and database credentials, as well as the modification of files or the initiation of further attacks on the internal network.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-6543

Affected Products

Langflow Desktop

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-6543 · Security Note
• https://twitter.com/VulmonFeeds/status/2049987588291735613 · Twitter Post
• https://reddit.com/r/pwnhub/comments/1t0sv7f/critical_command_injection_vulnerability_in_ibm · Reddit Post
• https://twitter.com/integ_sec/status/2052765211480785311 · Twitter Post
• https://ibm.com/support/pages/node/7271092 · Patch, Vendor Advisory
• https://twitter.com/CVEnew/status/2049970630867763328 · Twitter Post
• https://twitter.com/infoflowcloud/status/2049972523232530579 · Twitter Post
• https://t.me/CVEtracker/52361 · Telegram Post
• https://twitter.com/KaitanSecurity/status/2049979619156066324 · Twitter Post