CVE-2026-10561 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2026-10561 requires immediate attention.

· 7 min read

Executive Summary

CVE-2026-10561 is a critical remote code execution issue in IBM Langflow OSS 1.0.0 through 1.9.3. The flaw combines improper isolation of Python execution with an authentication bypass, allowing an unauthenticated attacker to run arbitrary code on the host system. In practical terms, this can mean full takeover of the server, theft of secrets, tampering with workflows, and lateral movement into connected services.

This is a CVSS 10 issue. Even though it is not currently known to be exploited in the wild and is not in CISA KEV, solo developers and small teams should treat it as an emergency if Langflow is internet-facing or reachable by untrusted users.

Immediate Action

  • Upgrade immediately to the first fixed release from IBM. If the fixed version is not yet confirmed, use the vendor advisory and install the latest patched build: IBM Security Advisory.
  • Take Langflow offline or isolate it behind VPN, firewall rules, or an internal-only network segment until patched.
  • Assume host compromise is possible if the service was exposed. Rotate API keys, database passwords, cloud credentials, and any secrets accessible to the process.
  • Rollback if needed to a known-safe environment snapshot only after patching the image or package; do not restore the vulnerable service unchanged.
  • Disable public access to any Langflow UI, API, or execution features until you have verified the fix.
  • Review logs for unexpected requests, process spawning, outbound connections, or file changes around the Langflow deployment window.

Affected Versions

  • ibm-langflow-oss@1.0.0 through 1.9.3 vulnerable.
  • ibm-langflow-oss@<=1.9.3 vulnerable; upgrade to TODO: first fixed version or later.
  • container image langflow:1.0.0 through langflow:1.9.3 vulnerable; move to langflow:TODO-fixed-tag or later.
  • Safe versions: TODO: confirmed fixed version(s) and any later release explicitly listed by IBM as patched.

Resolution Guide

If you use Langflow through a package manager or container, update to the fixed release as soon as it is available. Replace the TODO placeholders with the vendor-confirmed patched version.

# Python / pip
pip install --upgrade "ibm-langflow-oss==TODO-fixed-version"

# pipx
pipx upgrade ibm-langflow-oss

# JavaScript package managers (if bundled in your stack)
npm i ibm-langflow-oss@TODO-fixed-version
yarn add ibm-langflow-oss@TODO-fixed-version
pnpm add ibm-langflow-oss@TODO-fixed-version

# Java (if consumed as a dependency in a wrapper project)
# Maven
mvn versions:use-latest-releases
# Then pin the fixed version in pom.xml

# Gradle
./gradlew dependencyUpdates
# Then update the dependency version to TODO-fixed-version

# Linux package managers (if distributed as a system package)
sudo apt update && sudo apt install --only-upgrade ibm-langflow-oss
sudo yum update ibm-langflow-oss

# Docker
docker pull ibm/langflow:TODO-fixed-tag
docker stop langflow && docker rm langflow
docker run -d --name langflow ibm/langflow:TODO-fixed-tag

Hardening steps while you patch:

# Run with no outbound network if possible
docker run --network none ...

# Restrict to localhost or internal bind address
docker run -p 127.0.0.1:7860:7860 ...

# Example feature-flag style disablement (if supported by your deployment)
export LANGFLOW_DISABLE_EXECUTION=true
export LANGFLOW_ALLOW_UNAUTHENTICATED=false

Minimal patch idea: ensure execution endpoints require authentication and that Python execution is disabled by default unless explicitly enabled and sandboxed.

# Pseudocode / minimal defensive pattern
if not current_user.is_authenticated:
    raise HTTPException(status_code=401)

if not settings.allow_python_execution:
    raise HTTPException(status_code=403)

# Execute only in a constrained sandbox, never directly on host Python
run_in_sandbox(user_code)

Detection & Verification

Check your installed version:

python -c "import importlib.metadata as m; print(m.version('ibm-langflow-oss'))"
pip show ibm-langflow-oss
docker image inspect ibm/langflow:1.9.3 --format '{{.RepoTags}}'

Search deployment files and lockfiles:

grep -RIn "langflow" requirements.txt pyproject.toml poetry.lock Pipfile.lock docker-compose.yml .env
grep -RIn "1\.9\.[0-3]\|1\.0\." .

Use dependency auditors:

pip-audit
python -m pip check
npm audit
yarn audit
pnpm audit

Verify the fix: confirm the running version is above the vulnerable range and that unauthenticated requests are denied.

curl -i http://YOUR-HOST:7860/
curl -i http://YOUR-HOST:7860/api/health
# Expect 401/403 for protected execution endpoints, not code execution access

Also verify that the service no longer runs with broad host privileges, mounted secrets, or unrestricted shell access. If you use Docker, confirm the container is not privileged and does not mount the Docker socket.

Risk and Impact

The likely outcome is full remote compromise of the host. An attacker can execute arbitrary Python code, read environment variables, steal API tokens, modify application logic, and pivot to databases, cloud accounts, or source control systems reachable from the server.

For small teams, the blast radius can be larger than the app itself: one exposed Langflow instance may provide access to production secrets, CI/CD credentials, and internal network resources. Treat any internet-exposed deployment as high risk until patched and revalidated.

Keep reading