Vulnerability Report

CVE-2026-10561

RCE

Title: IBM Langflow OSS Unauthenticated Remote Code Execution

RCE, Complete System Compromise

Proof Of Concept

No public PoC currently indexed for CVE-2026-10561.

CWE Category CWE-94

Published Date Jun 22, 2026

Modified Date Jun 26, 2026

Exploit Status Not Found

Score 10.0 CVSS v3.1

Exploit Probability (EPSS)

0.50%

Vulnerability Summary

CVE-2026-10561: IBM Langflow OSS 1.0.0 through 1.9.3 has an vulnerability due to an improper isolation of Python execution combined with an authentication bypass that allows an unauthenticated attacker to execute arbitrary code on the host system, resulting in complete compromise

Impacted Vendors

langflow 1

Reference Links

https://www.ibm.com/support/pages/node/7277242

CVSS v3.1

Source Entity [email protected]

Severity CRITICAL

10.0

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

CHANGED

RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Associated Attack Patterns (CAPEC)

Total: Patterns