CVE-2026-9135: IBM Langflow OSS code injection in Policies ToolGuard integration
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-9135
- Published
- Record updated
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.8%
Summary
IBM Langflow OSS versions 1.0.0 through 1.10.0, including Langflow up to 1.9.2 (commit 94981c443d4918517b9e8163d70fc598dc33a32d), contain a code injection flaw in the Policies component's ToolGuard integration that bypasses the allow_custom_components=false control. Validation checks only node_template["code"]["value"], not the dynamic CodeInput fields that store generated ToolGuard Python files, so malicious Python persisted in Flow.data runs server-side when a guarded tool is invoked. Authenticated users with flow creation privileges can gain arbitrary Python execution, and the agentic MCP update_flow_component_field tool, which accepts attacker-controlled user_id parameters, enables cross-tenant injection into other users' flows.
Mitigation
The source does not state a fix yet. Check the original advisory for updates.
Related items
- MediumCVE-2026-127202: MLflow path traversal through model_id in the log outputs APISimilar attack · NVD/CVE Database
- LowAI chatbots are recommending fake retail websites, study findsSimilar attack · The Verge (AI)
- MediumPalo Alto tracks a massive Chinese AI attack that sadly lives up to industry fearsSimilar attack · CSO Online
- MediumAttackers Use Autonomous AI to Target Semiconductor, Defense and Civil Society SectorsSimilar attack · Palo Alto Unit 42
- MediumCVE-2026-126994: braindecode model config deserialization flaw via activation argumentSimilar attack · NVD/CVE Database