CVE-2026-9135: IBM Langflow OSS ToolGuard Code Injection Bypass
TL;DR - Critical Langflow OSS flaw enables authenticated server-side Python execution. - Affects IBM Langflow OSS 1.0.0 through 1.10.0; patch exists but fixed version is not confirmed in retrieved sources. - Prioritize upgrades and audit flows for malicious dynamic
CodeInputcontent.
Vulnerability at a Glance
| Field | Value |
|---|---|
| CVE ID | CVE-2026-9135 |
| CVSS | 9.9 (NVD) |
| Attack vector | Not confirmed from retrieved NVD vector string; network-reachable application-layer exposure should be assumed where Langflow is accessible |
| Privileges required | Authenticated user with flow creation privileges |
| Patch available | Yes, vendor states the issue was addressed; exact fixed version not confirmed in retrieved source text |
This is a critical code injection vulnerability in IBM Langflow OSS affecting the Policies component’s ToolGuard integration. The practical impact is backend Python code execution despite the defensive setting allow_custom_components=false, which many administrators may assume blocks this entire class of execution paths. It does not.
For defenders, the important nuance is that this is not described as an unauthenticated internet-wide RCE. The available source material says exploitation requires an authenticated user who can create or modify flows. That still makes the issue urgent in shared deployments, internal AI workflow platforms, development environments, and any Langflow instance exposed to multiple users or tenants.
What Is This Vulnerability?
At its core, CVE-2026-9135 is a validation bypass in Langflow’s flow component code verification logic. According to the NVD description and IBM advisory metadata, validation was applied to the primary component source field, node_template["code"]["value"], but did not extend to dynamic CodeInput fields used by the Policies component. Those dynamic fields could contain generated ToolGuard Python files.
That gap matters because the application later persists attacker-controlled content in Flow.data and executes it server-side when a guarded tool is invoked through the ToolGuard runtime. In other words, the security control was checking one executable code location while leaving another executable code path effectively unguarded. An attacker could place malicious Python in the unvalidated field, save the flow, and wait for runtime execution.
This is why the vulnerability is more serious than a simple policy bypass. The bypass reaches an execution sink on the backend. The result is arbitrary Python execution in the context of the Langflow service, with all the downstream implications that usually follow: workflow compromise, data access, secret exposure, lateral movement opportunities, or host-level impact depending on how the service is deployed.
The NVD record also notes a possible cross-tenant escalation angle involving the agentic MCP update_flow_component_field tool, which reportedly accepts attacker-controlled user_id values. If accurate in a given deployment, that could let one user inject malicious code into another user’s flows. That is especially relevant for hosted, multi-user, or weakly isolated Langflow environments.
Who Is Affected?
The retrieved sources identify the affected product as IBM Langflow OSS. The broad affected range reported by the NVD is “1.0.0 through 1.10.0.” The same NVD description also includes narrower implementation detail indicating the vulnerable code path exists in “Langflow versions up to 1.9.2 (commit 94981c443d4918517b9e8163d70fc598dc33a32d)”.
Because those two statements are not perfectly aligned, defenders should avoid over-interpreting the discrepancy. The safest reporting based on available evidence is:
- Affected: IBM Langflow OSS 1.0.0 through 1.10.0
- Specifically described vulnerable code path: versions up to 1.9.2 at commit 94981c443d4918517b9e8163d70fc598dc33a32d
If you run Langflow OSS anywhere in that range, treat the instance as affected until you can verify the vendor-fixed build in your environment. Do not assume that allow_custom_components=false materially protects you from this CVE if the vulnerable Policies and ToolGuard path is present.
Environments at highest risk include multi-user Langflow deployments, internal platforms where developers or analysts can create flows, instances with public-facing flows, and deployments using MCP tooling that can update component fields. If untrusted or semi-trusted users can create or modify flows, the exposure is operationally significant even without a public exploit.
CVSS Score Breakdown
NVD assigns CVE-2026-9135 a CVSS v3.x base score of 9.9, placing it firmly in critical territory. The exact vector string was not available in the retrieved tool output, so any component-by-component breakdown beyond the source-backed facts would be speculative. Still, the score itself strongly suggests severe impact with relatively accessible exploitation prerequisites in realistic deployments.
Based on the vulnerability description, the high score likely reflects backend code execution and the possibility of broad confidentiality, integrity, and availability impact once malicious Python runs in the Langflow service context. Even though the issue requires authentication and flow creation capability, those prerequisites do not reduce the risk enough to keep the score out of critical range, likely because many Langflow deployments intentionally grant those abilities to regular platform users.
For practitioners, the “so what” is simple: a 9.9 on an application platform used to orchestrate tools, code, data sources, and possibly credentials should be treated as a high-priority patching item. If your Langflow instance touches internal APIs, cloud tokens, vector stores, file systems, or orchestration backends, a successful exploit could extend far beyond the application itself.
Exploitation Status
At the time of the provided research note, active exploitation in the wild is not confirmed. CVE-2026-9135 does not appear in the CISA Known Exploited Vulnerabilities catalog, which means there is no CISA evidence-based federal exploitation signal attached to it right now.
Likewise, a public PoC is not confirmed from the retrieved primary-source set. No exploit repository, vendor-linked proof of concept, or authoritative public exploit reference was provided in the source material. That does not mean exploitation is impossible or unlikely. The technical description is detailed enough that capable researchers or attackers may be able to reproduce the issue from the advisory and code history.
Defenders should therefore use the following wording internally: - Public PoC: not confirmed - Exploitation in the wild: not confirmed - CISA KEV listed: no
In the absence of confirmed exploitation data, the prudent assumption is that exploit development is feasible for anyone with access to the affected code paths and sufficient familiarity with Langflow internals. That is enough to justify rapid remediation, especially in environments where users can create flows.
How to Detect It
Detection should focus on two areas: suspicious changes to stored flow definitions and suspicious runtime behavior when ToolGuard-guarded tools execute. Because the vulnerable input is persisted in Flow.data, retrospective review of stored flows is important, particularly if non-admin users had creation or editing rights.
You should also hunt for unusual Python content in dynamic component fields associated with the Policies component or ToolGuard-generated files. Any flow update activity involving dynamic CodeInput fields deserves scrutiny, especially if it includes imports, subprocess use, filesystem access, network callbacks, or code intended to fetch and execute remote content.
Technical Notes
Example strings and code artifacts worth hunting for in exported flow data, database records, or application logs:
update_flow_component_field
allow_custom_components=false
ToolGuard
CodeInput
Flow.data
import os
import subprocess
exec(
eval(
__import__(
requests.get(
If Langflow flow definitions are stored as JSON or can be exported, search for suspicious Python in dynamic fields:
grep -RniE 'CodeInput|ToolGuard|import os|import subprocess|exec|eval|__import__|requests.get(' /path/to/langflow/exports/
A basic Sigma-style concept for log or event searching could look like this:
title: Suspicious Langflow Flow Modification With Executable Python
logsource:
product: application
service: langflow
detection:
selection:
message|contains:
- "update_flow_component_field"
- "CodeInput"
keywords:
- "import os"
- "subprocess"
- "exec("
- "eval("
condition: selection and 1 of keywords
level: high
If your telemetry is centralized in Splunk, a starting hunt query might be:
index=app_logs ("Langflow" OR "langflow")
("update_flow_component_field" OR "CodeInput" OR "ToolGuard")
("import os" OR "import subprocess" OR "exec(" OR "eval(" OR "__import__(")
Also review process execution telemetry from the Langflow host or container. Unexpected child processes spawned by the Langflow service account shortly after a guarded tool invocation may indicate exploitation or at least malicious experimentation.
Mitigation and Patching
The vendor states a fix is available and describes the remediation as extending validation coverage to include all executable code fields. However, the exact fixed version number was not confirmed in the retrieved source text. Because the user requested a specific fixed version where available, the correct practitioner answer here is: the fixed version is unknown from the sources provided, so defenders should consult the IBM bulletin directly and verify package or image versions before closing the incident.
Until you can confirm and deploy the vendor-fixed release, reduce exposure by restricting who can create or edit flows, disabling or limiting public flow access, reviewing use of the Policies component and ToolGuard integration, and scrutinizing any MCP functionality that can update component fields. In multi-tenant environments, treat the issue as a possible tenant-isolation failure and evaluate whether cross-user flow modification is possible.
You should also assume that any previously editable flow may already contain malicious stored content if untrusted users had access. Patching alone may stop new injection, but it will not necessarily remove malicious code already saved in existing flow data. Review and sanitize flows before returning the instance to normal operation.
Technical Notes
Because the exact fixed version number was not confirmed, use vendor-approved package or image guidance from IBM before upgrading. Example commands below show how to inventory and upgrade carefully rather than implying a specific patched release number.
Check the current installed version:
langflow --version
If installed with pip, inventory first and then upgrade to the latest vendor-approved fixed release once confirmed:
python -m pip show langflow
python -m pip install --upgrade langflow
If deployed with Docker, pull and redeploy only after validating the fixed image tag from the vendor advisory or your internal artifact registry:
docker ps | grep -i langflow
docker images | grep -i langflow
docker pull langflowai/langflow:latest
Potential temporary workaround steps, pending patch validation:
1. Remove flow creation/edit rights from non-admin users.
2. Disable or tightly restrict public flow exposure.
3. Review and disable MCP tooling that can call update_flow_component_field where feasible.
4. Export and inspect existing flows for malicious Python in dynamic CodeInput fields.
5. Rotate credentials accessible to the Langflow service if suspicious flow modifications are found.
If you maintain reverse proxy or WAF controls, consider temporary rules that flag or block suspicious requests containing update_flow_component_field, CodeInput, or obvious Python execution strings. That will not replace patching, but it can reduce opportunistic abuse while remediation is underway.
References
The primary reference for severity, product naming, and technical summary is the NVD record for CVE-2026-9135. It provides the 9.9 CVSS score, identifies IBM Langflow OSS, and summarizes the validation bypass involving ToolGuard and dynamic CodeInput fields.
The IBM advisory is the authoritative vendor source for remediation status. Based on the retrieved bulletin metadata, IBM states the issue was fixed by extending validation to all executable code fields, but the exact fixed release number was not available in the supplied research text and should be verified directly before operational sign-off.
- NVD CVE record: https://nvd.nist.gov/vuln/detail/CVE-2026-9135
- IBM Security Bulletin: https://www.ibm.com/support/pages/node/7278920
- IBM canonical bulletin URL: https://www.ibm.com/support/pages/security-bulletin-policies-component-dynamic-codeinput-fields-bypass
For further understanding of related security concepts, you can explore our articles on what is Kerberoasting and what is an amplification attack.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.