CVE-2026-8635criticalCWE-94

CVE-2026-8635: fallo crítico en IBM Langflow OSS

Arbitrary Code Execution in Python Interpreter Component

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Langflow OSS

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

28Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 9.9epss 0.6%
IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated users to escalate privileges to superuser by directly manipulating the database, execute arbitrary system commands, and achieve full system compromise with Langflow service permissions.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Productos afectados
IBM · Langflow OSS
CVEs relacionadas — IBM Langflow OSS

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-9198CRITICALUnauthenticated Remote Code Execution via Auto-Login Bypass and Code ValidationEPSS 28.7%KEVCVE-2026-93674CRITICALLangflow OSS is affected by multiple vulnerabilitiesEPSS 15.3%CVE-2026-7873CRITICALCode Injection Vulnerability in Code Validation EndpointEPSS 6.2%CVE-2026-9103CRITICALUnauthenticated Superuser Token Issuance via Auto-Login EndpointEPSS 3.2%CVE-2026-10134CRITICALUnauthenticated Server-Side RCE via PythonCodeStructuredTool in Public FlowsEPSS 2.3%CVE-2026-93680CRITICALLangflow OSS is affected by multiple vulnerabilitiesEPSS 2.2%