Remote Code Execution Vulnerability in IBM Langflow OSS
CVE-2026-8182

8.8HIGH

Key Information:

Vendor

IBM
Status
Langflow Oss
Vendor
CVE Published:
5 August 2026

What is CVE-2026-8182?

An arbitrary code execution vulnerability has been identified in IBM Langflow OSS versions 1.0.0 through 1.10.3, enabling malicious actors to execute unauthorized code on the server without authentication by simply sending two HTTP requests. This poses a significant risk to the integrity and security of installations, potentially leading to data breaches and system manipulation. It is crucial for users of affected versions to apply the necessary security patches and follow best practices for safeguarding their systems.

Affected Version(s)

Langflow OSS 1.0.0 <= 1.10.3

References

https://www.ibm.com/support/pages/node/7282646
vendor-advisorypatch

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.