CVE-2026-9196 is a code injection flaw in IBM Langflow OSS 1.0.0 through 1.10.3. The Agentic Assistant runs model-generated Python in the backend during validation, before a user approves it. NVD scores it High (8.1). IBM recommends Langflow OSS 1.11.0 or newer.
What's affected
IBM's bulletin, first published 5 August 2026, lists Langflow OSS 1.0.0 through 1.10.3 as affected and recommends upgrading to 1.11.0 or newer. It lists no workarounds. The record agrees on the versions and on the score of 8.1 with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N.
The weakness is CWE-94, code injection. The bulletin is a roll-up covering several Langflow flaws, including others with higher scores such as an AST-scanning bypass rated 8.8. This post covers CVE-2026-9196 only, but the single upgrade matters for all of them.
How to check if you're exposed
Find the installed version:
pip show langflow
A version from 1.0.0 to 1.10.3 is affected. If you run the container image, check the tag.
Then ask whether the Agentic Assistant is enabled and who can reach it. The attacker in this case is an authenticated user, so a Langflow instance where many people have accounts, or one reachable from outside your network, is the case to prioritise. Also look at what the Langflow process can reach: network, files and credentials in its environment.
Paste a lockfile or SBOM into the free in-browser dependency scan to see whether this package is in your tree, including as a transitive dependency. Safeguard's reachability analysis can then show whether your code actually calls the affected path, which helps you order the work.
What to do now
- Upgrade Langflow OSS to 1.11.0 or newer, per IBM's recommendation.
- Limit accounts on the instance and require strong authentication for them.
- Run Langflow as a low-privilege user in a container with restricted network egress and no unneeded secrets in its environment.
- Review outbound connections and file changes from the Langflow host since you deployed an affected version.
Why it matters
IBM describes the problem as improper handling of components generated by a language model. The application validates a generated component by running its Python on the backend, before anyone has approved it. Any side effect of that code, such as network calls, file access or data leaving the host, then happens with the rights of the Langflow process.
The lesson for AI tooling in general is that model output is untrusted input. Running it to check it is the same as running it. Validation should use static checks or an isolated sandbox with no credentials. The KEV flag in the record is false and the bulletin does not say it is exploited.
Quick check
Does the user have to approve the code first?
IBM says the code runs during validation prior to user approval, which is the flaw.
Is upgrading the only fix?
IBM lists no workarounds and recommends moving to 1.11.0 or newer.
Sources
Last reviewed: 18 October 2026.
