CVE-2026-10561
Unauthenticated Remote Code Execution in Langflow OSS PythonREPLComponent via Builtins Injection
Description
IBM Langflow OSS 1.0.0 through 1.9.3 has an vulnerability due to an improper isolation of Python execution combined with an authentication bypass that allows an unauthenticated attacker to execute arbitrary code on the host system, resulting in complete compromise
INFO
Published Date :
June 22, 2026, 1:22 p.m.
Last Modified :
June 22, 2026, 1:22 p.m.
Remotely Exploit :
Yes !
Source :
ibm
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | CRITICAL | 9a959283-ebb5-44b6-b705-dcc2bbced522 | ||||
| CVSS 3.1 | CRITICAL | MITRE-CVE |
Solution
- Upgrade IBM Langflow to a patched version.
- Apply vendor security updates promptly.
- Review and harden access controls.
- Monitor for unauthorized activity.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-10561 vulnerability anywhere in the article.