CVE-2026-17624 is a code injection flaw in Langflow OSS 1.0.0 through 1.10.3. Weak validation of module imports lets a remote authenticated attacker execute arbitrary code. It scores 8.5, High. IBM recommends upgrading to Langflow OSS 1.11.0 or newer and lists no workaround.
What's affected
Langflow OSS 1.0.0 through 1.10.3, per IBM's bulletin, on Linux, macOS and Windows.
IBM recommends upgrading to Langflow OSS 1.11.0 or newer and lists no workarounds or mitigations. The bulletin (node 7282646) was last modified on 24 August 2026 and first published on 5 August 2026. The NVD text repeats the version range several times, which looks like a data glitch; the range is simply 1.0.0 to 1.10.3. The bulletin covers Langflow's Agentic Assistant and custom Python components, and seven CVEs in all.
The record scores it 8.5 (High) with vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H. The vector is network, high attack complexity, low privileges and changed scope, with high impact on all three properties. IBM's bulletin gives the same score.
How to check if you're exposed
Check the installed Langflow version in each environment where you run it: laptops, notebooks, containers and servers.
pip show langflow
pip list | grep -i langflow
docker image ls | grep -i langflow
The first two show the Python package version, and the third lists local container images so you can see the tags. Anything from 1.0.0 to 1.10.3 is in range. Also look in requirements.txt, pyproject.toml and lock files, because a pinned version in a repository will bring the problem back the next time someone rebuilds. This one needs an account, so the first question is who has one. In a single-user local install the exposure is small; on a shared server it is larger.
What to do now
- Find every Langflow install and record its version.
- Upgrade to Langflow OSS 1.11.0 or newer, in every environment and in any pinned dependency files.
- Review who has accounts on shared instances and whether they need to create or edit components.
- Langflow can run user-supplied Python and connects to external tools, so keep instances off the open internet and behind authentication, and run it as a low-privilege user with limited network access.
- Check the instance for components you did not create, and for outbound connections you do not expect. The bulletin gives no sign of exploitation, so this is a precaution.
Why it matters
The record classes the weakness as CWE-94, Improper Control of Generation of Code (code injection). Langflow lets users build workflows from components, and some of those components are Python code. That is useful and risky at once. To stay safe, the application tries to scan or restrict what that code may import and do. IBM's bulletin names the area: weaknesses in code security scanning, runtime validation, custom component execution paths and trusted code enforcement.
This CVE sits in that area. The record says module imports were not validated properly, and the record classes the weakness as CWE-94, improper control of generation of code. When a restriction on imports can be sidestepped, code that was supposed to be blocked can run in the Langflow process, with the privileges of that process. The changed scope in the vector reflects that reach.
The wider lesson from this bulletin is that scanners that try to decide whether code is safe are hard to get right. IBM lists several related issues in the same bulletin, including an AST scanning bypass and a hash weakness in a hardening mode, and fixes them in 1.11.0. Upgrade rather than patch around one of them. The record does not report exploitation and CISA does not list the CVE.
Try it yourself
A framework like Langflow can bring many findings at once. This demo shows how reachability analysis separates the ones your code can actually trigger from the ones it cannot.
Click through it at your own pace, or open it full screen.
Quick check
Does this need an account?
Yes. IBM describes a remote authenticated attacker, and the vector requires low privileges.
Is there a workaround?
IBM lists none. Upgrade to 1.11.0 or newer.
Sources
- IBM Security Bulletin 7282646: Langflow custom components, fetched 18 October 2026
Last reviewed: 18 October 2026.
