CVE-2026-8476: IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in the disk-based caching m

IBM Langflow OSS versions 1.0.0 through 1.10.0 have a critical vulnerability in their caching system that allows attackers to run arbitrary code on the server. The problem occurs because the software uses an unsafe deserialization method (pickle.loads(), which converts stored data back into Python objects without checking if it's trustworthy) to load cached data from disk, and attackers can exploit this by inserting malicious data through file access, workflow inputs, or API calls.