Description
IBM Langflow OSS 1.0.0 through 1.10.0 Langflow versions up to 1.9.2 (commit 94981c443d4918517b9e8163d70fc598dc33a32d) contain a code injection vulnerability in the Policies component's ToolGuard integration that bypasses the allow_custom_components=false security control. The vulnerability exists because the validation mechanism only checks the main component source code in node_template["code"]["value"] but fails to validate dynamic CodeInput fields that store generated ToolGuard Python files. Attackers can embed malicious Python code in these unvalidated dynamic fields, which are persisted in Flow.data and later executed server-side when a guarded tool is invoked through the ToolGuard runtime. This allows authenticated users with flow creation privileges to achieve arbitrary Python code execution on the backend despite custom component restrictions. The vulnerability can be escalated through cross-tenant flow manipulation via the agentic MCP update_flow_component_field tool, which accepts attacker-controlled user_id parameters, enabling attackers to inject malicious code into victim users' flows. When combined with publicly accessible flows and specific misconfigurations (AUTO_LOGIN=true, NEW_USER_IS_ACTIVE=true), the attack can be conducted with reduced authentication requirements.
Published: 2026-07-17
Score: 9.9 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

IBM Langflow OSS 1.0.0 through 1.10.0 contain a code injection flaw in the Policies component's ToolGuard integration. The flaw allows authenticated users who can create flows to embed malicious Python code in dynamic CodeInput fields, bypassing the allow_custom_components=false security setting. When a guarded tool is invoked, the unvalidated code is executed on the server, giving the attacker arbitrary Python execution on the backend. The vulnerability is a classic code injection (CWE‑94).

Affected Systems

The affected vendor is IBM and the product is Langflow OSS. Version 1.0.0 to 1.10.0, including the 1.9.x series up to commit 94981c443d, are impacted. The vulnerability is present in each release in that range.

Risk and Exploitability

The CVSS score is 9.9, reflecting a severe impact. The EPSS score is <1%, indicating that exploitation is currently unlikely but could be possible if attackers invest effort. The vulnerability is not listed in the CISA KEV catalog, but the high CVSS suggests it should be prioritized. Attackers need authenticated access with flow‑creation rights; cross‑tenant exploitation is possible through the agentic MCP update_flow_component_field tool when it accepts user_id parameters, and can be further simplified if misconfigurations such as AUTO_LOGIN and NEW_USER_IS_ACTIVE are enabled for publicly accessible flows. The risk to systems is therefore high for environments that allow privileged flow creation or that have the noted misconfigurations.

Generated by OpenCVE AI on July 30, 2026 at 23:50 UTC.

Remediation

Vendor Solution

IBM strongly recommends addressing the vulnerability now by upgrading Langflow OSS to version 1.10.1

OpenCVE Recommended Actions

  • Upgrade Langflow OSS to version 1.10.1 or later to address the injection flaw.
  • If upgrading is delayed, restrict the creation of dynamic CodeInput fields so that only authorized administrators can add or modify ToolGuard Python code.
  • Disable cross‑tenant flow manipulation by revoking or limiting the agentic MCP update_flow_component_field tool’s user_id parameter, and audit flow data for malicious content.

Generated by OpenCVE AI on July 30, 2026 at 23:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 20 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 17 Jul 2026 19:00:00 +0000

Type Values Removed Values Added
Description IBM Langflow OSS 1.0.0 through 1.10.0 Langflow versions up to 1.9.2 (commit 94981c443d4918517b9e8163d70fc598dc33a32d) contain a code injection vulnerability in the Policies component's ToolGuard integration that bypasses the allow_custom_components=false security control. The vulnerability exists because the validation mechanism only checks the main component source code in node_template["code"]["value"] but fails to validate dynamic CodeInput fields that store generated ToolGuard Python files. Attackers can embed malicious Python code in these unvalidated dynamic fields, which are persisted in Flow.data and later executed server-side when a guarded tool is invoked through the ToolGuard runtime. This allows authenticated users with flow creation privileges to achieve arbitrary Python code execution on the backend despite custom component restrictions. The vulnerability can be escalated through cross-tenant flow manipulation via the agentic MCP update_flow_component_field tool, which accepts attacker-controlled user_id parameters, enabling attackers to inject malicious code into victim users' flows. When combined with publicly accessible flows and specific misconfigurations (AUTO_LOGIN=true, NEW_USER_IS_ACTIVE=true), the attack can be conducted with reduced authentication requirements.
Title Policies Component Dynamic CodeInput Fields Bypass Custom Component Validation
First Time appeared Ibm
Ibm langflow Oss
Weaknesses CWE-94
CPEs cpe:2.3:a:ibm:langflow_oss:1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:langflow_oss:1.10.0:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm langflow Oss
References
Metrics cvssV3_1

{'score': 9.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'}

Subscriptions

Ibm Langflow Oss
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-07-23T03:56:03.838Z

Reserved: 2026-05-20T18:38:22.538Z

Link: CVE-2026-9135

cve-icon Vulnrichment

Updated: 2026-07-20T19:23:55.831Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T00:00:06Z

Weaknesses
  • CWE-94

    Improper Control of Generation of Code ('Code Injection')