CVE-2026-8635

IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated users to escalate privileges to superuser by directly manipulating the database, execute arbitrary system commands, and achieve full system compromise with Langflow service permissions.

Score

CVSS 3.1 9.9 Critical

Status

Analyzed - psirt@us.ibm.com

Published

2026-07-17

Last modified

2026-10-24

Weaknesses

CWE-94

Affected products

• Langflow Oss (Ibm)
• Langflow (Langflow)

References

• https://www.ibm.com/support/pages/node/7278925