Critical Code Injection Found in IBM Langflow

IBM Langflow OSS versions 1.0.0 through 1.10.0, specifically up to version 1.9.2, contain a critical code injection vulnerability identified as CVE-2026-9135. With a CVSS score of 9.9, this flaw enables attackers to bypass the allow_custom_components=false security control, leading to arbitrary Python code execution on the server.

What's at Risk

The vulnerability affects all deployments of IBM Langflow OSS within the specified version range. Organizations that rely on this platform for workflow automation, particularly those with internet-facing instances or environments where flow creation privileges are granted to multiple users, are at the highest risk.

The impact is significantly amplified in configurations where AUTO_LOGIN and NEW_USER_IS_ACTIVE settings are enabled, as these can lower the barrier for exploitation. Because the vulnerability allows for cross-tenant flow manipulation, any organization using a multi-user Langflow environment should consider their internal data and backend infrastructure potentially compromised.

How the Flaw Works

This vulnerability falls under the class of code injection, a weakness where an application fails to properly validate or sanitize user-supplied input before executing it as code. In general, this type of flaw allows an attacker to inject malicious instructions into a system, which the application then interprets and runs with the privileges of the host process.

When an application relies on a validation mechanism that only inspects primary source code fields while ignoring dynamic or secondary input fields, it creates a blind spot. Attackers typically exploit this by embedding payloads into these overlooked fields. Once the system processes this data, the malicious code is executed, effectively granting the attacker control over the underlying server environment. This class of vulnerability is particularly dangerous because it often bypasses application-level security sandboxes.

How to Protect Your Systems

• Immediately upgrade to a patched version of IBM Langflow OSS that addresses the ToolGuard integration vulnerability.
• Review and audit all existing flows for unauthorized or suspicious dynamic CodeInput field modifications.
• Disable AUTO_LOGIN and NEW_USER_IS_ACTIVE configurations if they are not strictly required for business operations.
• Implement strict network segmentation to ensure the Langflow server has minimal access to sensitive internal systems.
• Monitor server logs for unusual Python execution patterns or unauthorized modifications to flow data.
• Enforce the principle of least privilege by restricting flow creation and administrative access to a minimal set of trusted users.

Given the critical severity of this flaw and the potential for arbitrary code execution, organizations must prioritize patching. Failure to address this vulnerability leaves backend infrastructure exposed to full system compromise, making prompt remediation essential to maintaining the integrity of the development environment.