CVE-2026-7524 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2026-7524 requires immediate attention.

· 7 min read

Executive Summary

CVE-2026-7524 is a critical remote code execution issue in IBM Langflow OSS 1.0.0 through 1.9.1 caused by improper validation of symbolic links during archive extraction. In practical terms, a malicious archive can trick the extractor into writing files outside the intended directory, which can lead to arbitrary code execution on the host running Langflow. Even though this CVE is not currently known to be exploited in the wild and is not in CISA KEV, the severity is high enough that solo developers and small teams should treat it as an urgent patch-and-isolate event.

If you run Langflow in a container, VM, or shared dev box, assume the blast radius includes the application runtime, local secrets, mounted volumes, and any credentials accessible to the process. If you cannot patch immediately, isolate the service and stop accepting untrusted archives until remediation is complete.

Immediate Action

  • Upgrade Langflow immediately to a version that IBM has confirmed as fixed. If the fixed version is not yet known in your environment, use the vendor advisory and release notes: IBM security advisory / Langflow release notes.
  • Disable archive upload/extraction features or any workflow that imports user-supplied ZIP/TAR files until patched.
  • Isolate the service: run Langflow in a locked-down container or VM, remove host mounts, and restrict outbound network access where possible.
  • Roll back to a known-safe deployment only if the rollback target is confirmed not vulnerable and does not reintroduce the issue.
  • Rotate secrets that may have been exposed to the Langflow process, including API keys, tokens, and service account credentials.
  • Review recent archive uploads and logs for suspicious extraction behavior, unexpected file paths, or new files outside the intended workspace.

Affected Versions

  • langflow@1.0.0 through langflow@1.9.1 are vulnerable.
  • langflow@TODO_FIXED_VERSION+ should be treated as safe once IBM publishes the patched release.
  • If you vendor Langflow or package it into a custom image, any build that includes a vulnerable release is also affected.

Resolution Guide

JavaScript / npm / yarn / pnpm

npm install langflow@TODO_FIXED_VERSION
yarn add langflow@TODO_FIXED_VERSION
pnpm add langflow@TODO_FIXED_VERSION

Python / pip / pipx

pip install --upgrade langflow==TODO_FIXED_VERSION
pipx upgrade langflow

Java / Maven / Gradle

<dependency>
  <groupId>TODO_GROUP_ID</groupId>
  <artifactId>langflow</artifactId>
  <version>TODO_FIXED_VERSION</version>
</dependency>
./gradlew dependencies
# then update the Langflow version in build.gradle to TODO_FIXED_VERSION

Linux packages / containers

apt-cache policy langflow
sudo apt-get update && sudo apt-get install --only-upgrade langflow=TODO_FIXED_VERSION

yum list installed | grep -i langflow
sudo yum update langflow- TODO_FIXED_VERSION

Docker

docker pull TODO_VENDOR_IMAGE:TODO_FIXED_TAG
docker run --read-only --cap-drop=ALL --security-opt no-new-privileges \
  -p 7860:7860 TODO_VENDOR_IMAGE:TODO_FIXED_TAG

Hardening guidance

# Run as non-root
USER 10001

# Avoid host mounts for upload/extraction paths
# Do not mount /var/run/docker.sock
# Mount a dedicated scratch volume only if required

# Example feature flag / config toggle
LANGFLOW_DISABLE_ARCHIVE_IMPORT=true
LANGFLOW_ALLOW_UNTRUSTED_UPLOADS=false

Minimal code fix pattern if you maintain a fork or wrapper:

from pathlib import Path

def safe_extract_path(base_dir: str, member_name: str) -> Path:
    base = Path(base_dir).resolve()
    target = (base / member_name).resolve()
    if not str(target).startswith(str(base) + "/"):
        raise ValueError("Blocked path traversal / symlink escape")
    return target

This is a defensive pattern only; prefer the vendor patch over local hotfixes. If you must patch locally, ensure archive extraction rejects symlinks, hardlinks, absolute paths, and any member that resolves outside the intended directory.

Detection & Verification

Check your installed version

python -c "import langflow; print(langflow.__version__)" 2>/dev/null
pip show langflow
npm ls langflow
yarn why langflow
pnpm why langflow

Search lockfiles and manifests

grep -RIn "langflow" package-lock.json yarn.lock pnpm-lock.yaml requirements.txt pyproject.toml pom.xml build.gradle .

Audit dependencies

npm audit
pip-audit
pip check
mvn dependency:tree
./gradlew dependencies

Look for suspicious extraction artifacts

find /path/to/langflow/data -type l -ls
find /path/to/langflow -path '*uploads*' -o -path '*extract*' -o -path '*tmp*' | head
grep -RIn "tarfile\|zipfile\|extract" /path/to/your/app

Verify the fix

# Confirm the version is at or above the fixed release
pip show langflow | grep Version
python -c "import langflow; print(langflow.__version__)"

# Re-run dependency audit and ensure no vulnerable version remains
pip-audit
npm audit --production

Risk and Impact

This flaw can let an attacker turn a file upload or imported archive into code execution on the Langflow host. For small teams, that often means exposure of local environment variables, API keys, database credentials, and any mounted source code or secrets. If Langflow runs with broad filesystem access or inside a privileged container, the impact can spread beyond the app itself to the rest of the workstation or server.

Even without known active exploitation, the combination of critical severity and easy delivery via archive handling makes this a high-priority fix. Treat any untrusted archive as hostile until you have confirmed the patched release and hardened the runtime.

Keep reading