CVE-2026-13435: IBM Langflow OSS PythonREPL Sandbox Bypass
TL;DR - Critical flaw in IBM Langflow OSS lets attacker-supplied input bypass Python sandbox validation. - Affects Langflow OSS 1.0.0 through 1.10.1 where vulnerable Python execution paths are reachable. - Patch guidance exists, but the exact fixed version was not explicitly visible in the retrieved advisory snippet, so treat this as urgent.
Vulnerability at a Glance
| Field | Value |
|---|---|
| CVE ID | CVE-2026-13435 |
| CVSS score | 9.9 (Critical) |
| Attack vector | Not explicitly provided in the retrieved NVD result; practically, exposure depends on attacker-controlled input reaching vulnerable flow, agent, or permitted run paths |
| Auth required | Not explicitly stated in the retrieved sources |
| Patch available | Vendor advisory exists; exact fixed version was not explicitly visible in the retrieved advisory snippet |
CVE-2026-13435 is a critical improper input validation issue in IBM Langflow OSS. The vulnerable area is the PythonREPL sandbox implementation, with IBM further identifying the affected functionality as the Python Interpreter component and the legacy Python REPL Tool component. In plain terms, code that was supposed to run in a constrained environment could bypass the validator and access sensitive process data.
For defenders, the headline is not just “sandbox escape.” IBM states successful exploitation may expose server process environment variables and in-memory application settings, including provider API keys, database credentials, and key material used for JWT signing and encryption of stored credential variables. In default HS256 JWT deployments, that may enable forged access tokens and decryption of stored secrets, which materially raises incident severity.
What Is This Vulnerability?
The root cause, per NVD and IBM, is improper input validation in the PythonREPL sandbox implementation. IBM’s advisory adds important context: Langflow’s Python execution features attempted to constrain user-supplied code through scoped globals, an operator-defined import allow-list, and curated safe builtins. The vulnerability is that an attacker can supply code that bypasses this validation logic when their input reaches a deployed flow, agent, or another permitted execution path invoking the vulnerable components.
That matters because the trust boundary is the sandbox itself. If validation can be bypassed, the effective security model changes from “restricted code execution” to “attacker-influenced code with access to sensitive runtime state.” In AI workflow platforms, that runtime state often includes provider credentials, backend database access details, API tokens, and application secrets loaded into environment variables. Once those secrets are exposed, the attacker may not need repeated code execution to continue compromise.
IBM also highlights a particularly serious follow-on risk: under the default HS256 JWT configuration, exposed signing key material could allow an attacker to forge valid access tokens for a known user identifier. If the same application instance also stores encrypted credentials using server-held key material, theft of those keys could enable decryption of previously protected secrets. That expands impact from local data disclosure to durable authentication bypass and broader application compromise.
Technical Notes
A simplified model of the vulnerable pattern is “untrusted Python reaches a sandbox that relies on validator restrictions rather than isolation guarantees.” Even without a public exploit sample, defenders should assume the danger zone includes any feature path that evaluates or interprets user-controlled Python in-process.
# Conceptual example only, not a vendor-provided PoC
user_supplied_code = request.json["code"]
safe_globals = {"__builtins__": curated_builtins}
allowed_imports = {"math", "json"}
# If validator logic can be bypassed, these controls may not hold
validate(user_supplied_code, allowed_imports)
exec(user_supplied_code, safe_globals, {})
Operationally, the risk is highest when Langflow is exposed to untrusted users, multi-tenant workloads, or externally reachable APIs that allow flow execution with attacker-controlled prompt or tool input.
Who Is Affected?
The affected product named in NVD and IBM’s advisory is IBM Langflow OSS. The affected version range is 1.0.0 through 1.10.1. That range should be read as inclusive based on standard advisory semantics. If your deployment is running any release from 1.0.0 up to and including 1.10.1, it should be considered vulnerable unless IBM release documentation for your exact build says otherwise.
The retrieved advisory materials did not explicitly show the fixed version number in the visible snippet. Because of that, defenders should avoid guessing during change control. The safest operational statement is: all Langflow OSS deployments on 1.0.0 through 1.10.1 require immediate review and vendor-verified remediation. Based on the affected range, a post-1.10.1 release is likely intended to contain the fix, but that should be confirmed directly from IBM release notes or the full bulletin before standardizing an upgrade target.
Who is practically exposed depends on configuration and usage. If you do not use the Python Interpreter component or the legacy Python REPL Tool in any reachable flow or agent path, exploitability may be reduced. But if those components are enabled in flows that accept user-controlled input, especially in shared or internet-facing environments, exposure is much more serious. In the absence of explicit vendor guidance on preconditions, defenders should assume reachable Python execution features are high risk.
A second group that is indirectly affected includes organizations that embed Langflow into larger internal AI platforms. Even if Langflow is not internet-facing, it may still be reachable by lower-trust internal users, contractors, or adjacent automation systems. Given the potential to expose JWT keys and encrypted credential material, this CVE should be treated as a platform trust issue rather than an isolated feature bug.
CVSS Score Breakdown
The published base severity is CVSS v3.1 9.9 (Critical). The retrieved NVD result did not include the full vector string, so some component-level interpretation remains constrained. Still, a 9.9 score strongly implies a combination of severe impact and relatively accessible exploitation conditions. In practice, that aligns with IBM’s description of sensitive data exposure affecting high-value secrets and possibly enabling token forgery.
From an impact perspective, this vulnerability is consistent with high confidentiality impact because environment variables, in-memory settings, API keys, database credentials, JWT signing material, and encryption keys may be exposed. Integrity impact is also plausibly high when forged JWTs can be created and used to impersonate users. Availability impact is less clearly stated in the sources, so defenders should not assume service disruption is the primary concern. The bigger issue is compromise of trust, secrets, and authentication controls.
Because the attack vector and privileges required were not explicitly provided in the retrieved CVSS data, practitioners should avoid overfitting to assumptions like “network exploitable without auth” or “requires authenticated flow author access.” The safer operational stance is to review every path where external or lower-trust input can reach vulnerable Python execution features. If your environment allows broad user interaction with flows or agents, treat exposure as urgent even without a published vector string.
A high CVSS score should not be the only driver here. The combination of secret disclosure plus possible JWT forgery means this bug can undermine compensating controls elsewhere in the stack. Even if direct exploitability is limited to certain workflows, a successful compromise may invalidate stored credentials and session trust across the platform.
Exploitation Status
Based on the sources retrieved for this article, there is no confirmed in-the-wild exploitation reported for CVE-2026-13435. It was not listed in CISA’s Known Exploited Vulnerabilities catalog at the time of lookup. That is useful context, but it is not evidence the vulnerability is safe to defer. KEV absence only means CISA had not cataloged confirmed exploitation at lookup time.
Also based on the retrieved sources, no verified public proof-of-concept was identified. That should be stated carefully: no verified public PoC was found in the materials used here, not that a PoC definitely does not exist. Security teams should assume that critical flaws in AI tooling and code-execution features often attract researcher and attacker interest quickly, especially when the impact includes credential exposure and token forgery.
The prudent reading is: exploitation is not confirmed, and a public PoC is not known from the retrieved primary sources. In that uncertainty window, defenders should still prioritize remediation because the technical description is sufficiently detailed to guide exploit development. Attackers do not necessarily need a polished PoC release when the advisory already describes the vulnerable components and the resulting access to sensitive runtime material.
For organizations with exposed Langflow instances, the absence of a public PoC should not materially change response priority. A critical sandbox bypass in a Python execution path is the kind of issue that often transitions from advisory to exploit experimentation quickly.
How to Detect It
Detection should focus on two things: use of the vulnerable Python execution components, and signs that runtime secrets or token material have been accessed or abused. Start by inventorying any Langflow flows, agents, or run paths that invoke the Python Interpreter or legacy Python REPL Tool. If you have audit logs for flow execution, identify executions originating from untrusted users, public APIs, or unusual sources immediately before suspicious authentication events or secret usage anomalies.
Because the advisory describes disclosure of environment variables and in-memory settings, defenders should also watch for secondary indicators: sudden use of valid but unexpected JWTs, access from anomalous user identifiers, unexpected decryption or retrieval of stored credentials, outbound connections using previously dormant provider keys, and database access from unusual client contexts. If you cannot directly detect the sandbox bypass, detect the consequences.
Technical Notes
Concrete log content will vary by deployment, reverse proxy, and Langflow logging configuration. In the absence of vendor-published IOCs, look for requests and task traces involving Python execution endpoints, tool names, or flow nodes associated with interpreter features.
Example grep patterns for application and reverse proxy logs:
grep -RniE 'PythonREPL|Python REPL|Python Interpreter|tool.*python|exec|sandbox' /var/log/langflow* /var/log/nginx/* /var/log/httpd/*
If Langflow logs JSON events for flow execution, search for suspicious runs invoking interpreter components from unexpected users or source IPs:
jq 'select(.component? | tostring | test("PythonREPL|Python Interpreter|REPL"; "i"))' /var/log/langflow/events.json
Example Splunk search for suspicious execution followed by anomalous auth activity:
(index=app OR index=proxy) ("PythonREPL" OR "Python Interpreter" OR "legacy Python REPL")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip user component flow_id
| join type=left src_ip [ search index=auth ("jwt" OR "token") ("issued" OR "accepted" OR "validated") | stats count by src_ip user ]
Example Sigma-style idea for web logs where request bodies or paths expose interpreter invocation metadata:
title: Langflow Python Execution Path Access
status: experimental
logsource:
category: webserver
detection:
selection:
cs-uri|contains:
- "flow"
- "run"
keywords:
- "PythonREPL"
- "Python Interpreter"
- "legacy Python REPL"
condition: selection and keywords
level: high
Also review for unexplained JWT validation success tied to newly seen clients. If signing material was exposed, the attacker may pivot directly to forged tokens rather than repeatedly exercising the original bug.
Mitigation and Patching
The primary remediation is to upgrade off the affected range of 1.0.0 through 1.10.1 to a vendor-verified fixed release. Important caveat: the exact fixed version number was not explicitly shown in the retrieved advisory snippet. While a release later than 1.10.1 is likely to be the fix boundary, defenders should verify the precise target version in IBM’s full advisory or release notes before rollout. Do not record a guessed fixed version in internal change tickets without vendor confirmation.
If immediate upgrade is not possible, reduce exploitability by disabling or removing access to the vulnerable Python execution features wherever feasible. Specifically review the Python Interpreter component and the legacy Python REPL Tool in deployed flows and agents. Restrict who can invoke affected flows, remove public exposure, require stronger authentication around execution endpoints, and place Langflow behind a trusted reverse proxy or VPN while remediation is pending. These are temporary risk-reduction steps, not substitutes for patching.
Because IBM states secret material may be exposed, incident response must include credential hygiene, not just software updates. If you suspect exploitation, rotate provider API keys, database passwords, JWT signing keys, and any encryption keys used for stored credentials. Re-issue tokens after key rotation and invalidate sessions as appropriate. If default HS256 was in use, assume token trust may have been compromised until you complete key rotation and log review.
Technical Notes
Upgrade commands depend on how Langflow OSS is deployed. Verify the vendor-approved fixed version first, then use the appropriate package or container update path.
Example Python package upgrade flow:
# Verify installed version
python -m pip show langflow
# Upgrade to the vendor-verified fixed version once confirmed
python -m pip install --upgrade 'langflow==<FIXED_VERSION>'
Example container-based workflow:
# Pull and deploy the vendor-verified fixed image tag
docker pull langflowai/langflow:<FIXED_VERSION>
docker stop langflow
docker rm langflow
docker run -d --name langflow -p 7860:7860 langflowai/langflow:<FIXED_VERSION>
If you need a temporary workaround before patching, remove or disable vulnerable interpreter-based flows and block external access to execution endpoints at the reverse proxy:
# Example defensive restriction, adapt to your deployment
location /api/v1/run {
allow 10.0.0.0/8;
deny all;
}
Post-patch, rotate secrets and redeploy with fresh values:
# Example only; use your actual secret management process
export JWT_SECRET="<new-random-secret>"
export DATABASE_URL="<rotated-db-credential>"
export PROVIDER_API_KEY="<rotated-provider-key>"
systemctl restart langflow
Finally, validate that no legacy flows still expose the Python Interpreter or legacy Python REPL Tool after the upgrade. A fixed binary does not help if deprecated risky patterns remain unnecessarily enabled.
References
The primary source for this CVE is the NVD record, which identifies the product, affected version range, severity, and high-level vulnerability class. For practitioners, IBM’s advisory is the more useful source because it describes the vulnerable components and spells out the impact on runtime secrets, JWT signing material, and encrypted credential storage.
Use the references below to verify affected versions, monitor updates to vendor remediation guidance, and confirm whether IBM later clarifies the fixed version, exploit preconditions, or additional hardening steps. Because the exact fixed version was not visible in the retrieved snippet, defenders should revisit the vendor advisory directly during patch planning.
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-13435
- IBM advisory node: https://www.ibm.com/support/pages/node/7279987
- IBM canonical advisory URL: https://www.ibm.com/support/pages/security-bulletin-python-interpreter-sandbox-bypass-leading-sensitive-data-exposure-0
For security teams maintaining internal advisories, record the following status explicitly to avoid overstatement: - Affected versions: IBM Langflow OSS 1.0.0 through 1.10.1 - Fixed version: Not explicitly visible in the retrieved advisory snippet; verify with IBM before deployment - Public PoC: Not known from retrieved primary sources - Confirmed in-the-wild exploitation: Not confirmed - CISA KEV status at lookup time: Not listed
For further insights on related vulnerabilities, check out our articles on CVE-2026-7312 and what is a penetration test.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.