CVE-2026-9201: IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute arbitrary code due to a cryptogra

IBM Langflow OSS versions 1.0.0 through 1.10.3 have a security flaw in how they validate custom components when hardening mode is enabled. An authenticated attacker can exploit a cryptographic weakness (truncated SHA-256 hash, a shortened version of a security fingerprint) to create malicious code that appears to match trusted templates, allowing them to run arbitrary Python code and potentially take over the affected system.