PT-2026-51298

CVE-2026-10561

·

Published

2026-06-22

·

Updated

2026-10-19

Description by

CVSS 3.1
10
Critical
MetricsAV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.9.3
Description Improper isolation of Python execution combined with an authentication bypass allows an unauthenticated remote attacker to execute arbitrary code on the host system, leading to a complete compromise of the system.
Recommendations Upgrade to the latest patched version.
Exploitability
Fix
Impacts
Vendors
Affected products
Weakness enumeration
CWE-94: Improper Control of Generation of Code (\'Code Injection\')
CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (\'Eval Injection\')
CWE-266: Incorrect Privilege Assignment
Related identifiers
CVE-2026-10561
GHSA-8QPJ-27X8-PWPQ
GHSA-FRVG-495W-M47V
PYSEC-2026-4231
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com