Remote Code Execution Vulnerability in IBM Langflow OSS Product

CVE-2026-8476

What is CVE-2026-8476?

IBM Langflow OSS versions 1.0.0 to 1.10.0 contain a vulnerability allowing remote code execution due to insecure deserialization in the AsyncDiskCache class. This flaw stems from the use of Python's unsafe pickle.loads() function, which processes cached objects without any validation or authentication. An attacker with the ability to manipulate cached data, whether through file system access, malicious inputs, or API alterations, can execute arbitrary code, compromising the Langflow server's security entirely.

References