CVE-2026-10561

critical · 10

IBM Langflow OSS 1.0.0 through 1.9.3 has an vulnerability due to an improper isolation of Python execution combined with an authentication bypass that allows an unauthenticated attacker to execute arbitrary code on the host system, resulting in complete compromise

CVSS

1.0%

EPSS (exploit prob.)

61st

EPSS percentile

2026-06-22

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weaknesses

CWE-94

Affected products

Vendor	Product	Affected versions
langflow	langflow	>= 1.0.0, <= 1.9.3

Check a specific version with /api/v1/cve/match.

References

https://www.ibm.com/support/pages/node/7277242

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-10561