CVE-2026-17624: IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1
Summary
IBM Langflow OSS versions 1.0.0 through 1.10.3 contain a vulnerability that allows a remote authenticated attacker (someone with login access) to run arbitrary code (any commands they choose) due to improper validation of module imports (not properly checking which code libraries are being loaded). The vulnerability is classified as CWE-94, a type of code injection (inserting malicious code into a program).
Vulnerability Details
8.5(high)
EPSS: 0.0%
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
network
high
low
none
August 5, 2026
Classification
Affected Vendors
Related Issues
CVE-2026-34371: LibreChat is a ChatGPT clone with additional features. Prior to 0.8.4, LibreChat trusts the name field returned by the e
CVE-2024-27444: langchain_experimental (aka LangChain Experimental) in LangChain before 0.1.8 allows an attacker to bypass the CVE-2023-
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-17624
First tracked: August 5, 2026 at 08:08 PM
Classified by LLM (prompt v3) · confidence: 85%