CVE-2026-17633: High Code Injection in Langflow OSS

CVE-2026-17633 is a code injection flaw in Langflow OSS 1.0.0 through 1.10.3. IBM says a remote authenticated attacker could execute arbitrary code. It scores 8.5, High. IBM recommends upgrading to Langflow OSS 1.11.0 or newer and lists no workaround or mitigation for the bulletin.

What's affected

Langflow OSS 1.0.0 through 1.10.3, per IBM's bulletin, on Linux, macOS and Windows.

IBM recommends upgrading to Langflow OSS 1.11.0 or newer and lists no workarounds or mitigations. The bulletin (node 7282646) was last modified on 24 August 2026 and first published on 5 August 2026. IBM gives no detail beyond the phrase code injection, so we do not describe the mechanism.

The record scores it 8.5 (High) with vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H. The vector is network, high attack complexity, low privileges and changed scope, with high impact on all three properties. IBM's bulletin gives the same 8.5.

How to check if you're exposed

Check the installed Langflow version in each environment where you run it: laptops, notebooks, containers and servers.

pip show langflow
pip list | grep -i langflow
docker image ls | grep -i langflow

The first two show the Python package version, and the third lists local container images so you can see the tags. Anything from 1.0.0 to 1.10.3 is in range. Also look in requirements.txt, pyproject.toml and lock files, because a pinned version in a repository will bring the problem back the next time someone rebuilds. Because the advisory gives so little detail, check by version and not by symptom.

What to do now

1. Find every Langflow install and record its version.
2. Upgrade to Langflow OSS 1.11.0 or newer, in every environment.
3. Limit accounts on shared instances to people who need them, since the attack needs a login.
4. Langflow can run user-supplied Python and connects to external tools, so keep instances off the open internet and behind authentication, and run it as a low-privilege user with limited network access.
5. Subscribe to IBM security bulletins for Langflow, because several issues were fixed at once and more detail may follow.

Why it matters

The record classes the weakness as CWE-94, Improper Control of Generation of Code (code injection). IBM's description for this CVE is one line: a remote authenticated attacker could execute arbitrary code due to code injection. The record classes it as CWE-94. IBM does not say which input or feature is affected, and the bulletin around it deals with Agentic Assistant output and custom Python components. We will not guess which of those paths applies, because the advisory does not say.

What can be said with confidence is the shape of the risk. An authenticated user reaching code execution in the Langflow process can read whatever the process can read: environment variables, API keys for model providers, the database and uploaded files. Many Langflow installs hold secrets for several external services, so the process is a worthwhile target.

The vector sets attack complexity to high, which says the attack is not trivial to carry out. That is a reason to apply the upgrade on your normal fast schedule and not a reason to skip it. The bulletin lists six other CVEs, all fixed by the same upgrade. No exploitation is reported in the record and the CVE is not in the CISA catalog.

Try it yourself

Not every code execution finding is equally likely to be used against you. This demo walks through an exploitability check so you can see which findings deserve the fast lane.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• IBM Security Bulletin 7282646: Langflow custom components, fetched 18 October 2026

Last reviewed: 18 October 2026.