VULNERABILITY INTELLIGENCE

CVE-2026-8635

CVSS score9.9 CRITICAL
EPSS probability0.59%
CISA KEVNot currently listed
Published2026-07-17
Last modified2026-10-24
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Description

IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated users to escalate privileges to superuser by directly manipulating the database, execute arbitrary system commands, and achieve full system compromise with Langflow service permissions.

Weakness classification

  • CWE-94: Improper Control of Generation of Code ('Code Injection')

Primary references