CVE-2026-8635

critical · 9.9

IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated users to escalate privileges to superuser by directly manipulating the database, execute arbitrary system commands, and achieve full system compromise with Langflow service permissions.

9.9

CVSS

0.5%

EPSS (exploit prob.)

44th

EPSS percentile

2026-07-17

Published

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weaknesses

CWE-94

Affected products

Vendor	Product	Affected versions
langflow	langflow	>= 1.0.0, < 1.10.1
apple	macos	all versions
linux	linux_kernel	all versions
microsoft	windows	all versions

Check a specific version with /api/v1/cve/match.

References

https://www.ibm.com/support/pages/node/7278925

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-8635