CVE-2026-10134: 
Homebrew vulnerability analysis and mitigation

CVE-2026-10134 is a critical code injection vulnerability (CWE-94) in IBM Langflow OSS versions 1.0.0 through 1.9.3 that allows unauthenticated remote attackers to execute arbitrary code and fully compromise the application. The vulnerability was published on June 30, 2026, with an IBM advisory and GitHub Security Advisory (GHSA-mgqp-4wrr-7886) released the same day. It carries a CVSS v3.1 base score of 10.0 (Critical), reflecting its network-accessible, no-authentication, no-user-interaction attack profile with a changed scope (GitHub Advisory, IBM Advisory).

The root cause is improper control of code generation (CWE-94), where IBM Langflow OSS fails to adequately neutralize externally-influenced input used to construct code segments. An unauthenticated attacker can exploit this over the network with low complexity by injecting malicious code into a public flow's tool_code field. Once injected, the malicious code is re-executed server-side every time any user triggers a normal /api/v1/build/... API call, enabling persistent, automated code execution without further attacker interaction. The attack maps to CAPEC-242 (Code Injection) and CAPEC-77 (Manipulating User-Controlled Variables) (GitHub Advisory, IBM Advisory).

Successful exploitation grants an unauthenticated attacker complete control over the Langflow instance, including the ability to read all secrets accessible to the Langflow process, read and modify every flow, conversation, message, file upload, and saved component in the database, connect to internal services, and abuse cloud metadata endpoints (e.g., AWS IMDSv1). The attacker can laterally move to other tenants on the same Langflow instance and establish persistent code execution by modifying public flow tool_code, causing attacker code to run on every subsequent build triggered by any legitimate user. The NVD SSVC assessment rates the technical impact as "total" and the vulnerability as automatable (GitHub Advisory, IBM Advisory).

1. Reconnaissance: Identify internet-facing IBM Langflow OSS instances (versions 1.0.0–1.9.3) using tools like Shodan or Censys, searching for Langflow's default web interface or API endpoints.
2. Identify public flows: Query the Langflow API (e.g., GET /api/v1/flows/) without authentication to enumerate publicly accessible flows that expose a tool_code field.
3. Inject malicious code: Craft an API request (e.g., PATCH or PUT to the relevant flow endpoint) that modifies the target public flow's tool_code parameter to include arbitrary Python or shell code (e.g., a reverse shell, credential harvester, or persistence mechanism).
4. Trigger execution: Wait for any legitimate user to invoke a build operation via /api/v1/build/..., which will automatically execute the injected tool_code server-side under the Langflow process context.
5. Establish persistence and pivot: Use the code execution to exfiltrate secrets from the Langflow process environment, access cloud metadata endpoints (e.g., http://169.254.169.254/latest/meta-data/), read/modify the database, and pivot to other tenants or internal services (GitHub Advisory, IBM Advisory).

• Network: Unexpected outbound connections from the Langflow server to external IPs or cloud metadata endpoints (e.g., 169.254.169.254); unusual API calls to internal services originating from the Langflow process.
• Logs: Unauthenticated or anomalous PATCH/PUT requests to flow endpoints in Langflow API access logs; repeated /api/v1/build/... calls resulting in unexpected process spawning or errors.
• File System: New or modified files in the Langflow working directory created by the Langflow process account; unexpected scripts or binaries dropped by the application.
• Process: Unusual child processes spawned by the Langflow Python process (e.g., bash, sh, curl, wget, python); unexpected network connections initiated by the Langflow service.
• Database: Unauthorized modifications to flow records, particularly changes to tool_code fields in public flows; new or altered conversation, message, or component records not attributable to legitimate users (GitHub Advisory).

IBM has released a patch addressing this vulnerability; users should upgrade IBM Langflow OSS to a version beyond 1.9.3 as the primary remediation (IBM Advisory). As interim workarounds: restrict network access to Langflow instances to trusted networks only and disable public internet exposure; rotate all secrets and credentials stored in or accessible by the Langflow process; audit all flows and components for unauthorized tool_code modifications; and implement network segmentation to limit lateral movement between Langflow tenants and to internal services. Review Langflow API access logs for evidence of unauthorized flow modifications.

The vulnerability received coverage from security news outlets including SecurityOnline.info, which covered it as part of a broader Langflow OSS vulnerability report and in a weekly threat intelligence roundup (SecurityOnline). Hawk-Eye.io included it in their weekly threat landscape digest for Week 28 of 2026 (Hawk-Eye). Community aggregators such as VulDB and CVEFeed.io also indexed the vulnerability shortly after disclosure, reflecting standard industry tracking of a critical-severity IBM advisory.