Advisory · CVE-2026-10561
Langflow's Python sandbox leaks a full remote shell
Langflow OSS combines a Python builtins injection flaw with default auto-login, giving unauthenticated attackers remote code execution on the host.
- Vendor
- IBM
- Product
- Langflow
- Identifier / CWE
- CVE-2026-10561
CWE-94 - Action timing
- Immediate
Explain it like I’m five
Langflow lets visitors run little calculator programs but forgot to take away the calculator's access to the filing cabinet and the front door. Since the front door is also unlocked by default, anyone walking by can take over the whole building.
- 01Find an exposed instance
The attacker locates a Langflow deployment reachable on the network, which by default auto-logs users in.
- 02Get a superuser token
The default auto-login behavior issues a superuser token with no credentials required.
- 03Abuse the Python component
The attacker calls the Python Interpreter component, whose restricted globals never clear builtins, so exec() restores import, open, and eval.
- 04Own the host
Arbitrary OS commands run at backend process privilege, exposing LLM provider keys, flow definitions, and the host itself.
What happened
IBM disclosed CVE-2026-10561, an unauthenticated remote code execution vulnerability in Langflow OSS (CVSS 10.0). Two weaknesses combine: the PythonREPLComponent builds a restricted globals dictionary from an import whitelist but never clears builtins, so CPython’s exec() silently restores the full builtins module, making import, open, and eval reachable regardless of the whitelist; and default deployments enable auto-login, which mints superuser tokens to any network caller with no credentials. Together they yield arbitrary OS command execution on the host, LLM provider key exfiltration, and full compromise. Affected versions are 1.0.0 through 1.9.3; IBM lists no workaround. Thousands of Langflow instances are reachable on the internet, and past Langflow RCE flaws have been exploited within roughly a day of disclosure. No confirmed exploitation of this specific CVE has been reported at the time of writing.
What to do
- Upgrade to the latest Langflow release; versions 1.0.0 through 1.9.3 are affected per IBM’s bulletin, so anything in that range must move.
- Do not expose Langflow to the internet; put authentication in front of the API and restrict network access to trusted operators.
- Rotate everything the process could read: LLM provider API keys in the environment and database, the Langflow superuser password and secret key, database credentials, and any SSH keys on the host.
- Investigate for prior compromise: review access logs for the auto-login endpoint and code execution paths, and treat any sign of unexpected access as a full host compromise.
Management note
This is the classic AI-tooling trap: a product whose job is running user-supplied code, shipped with no authentication by default and an internet-facing port. The 10.0 is almost beside the point; the architecture is the vulnerability. If your teams run Langflow, the question to ask is not just whether it is patched, but why an unauthenticated code-execution service was reachable at all.