Skip to content
Threat Feed
Subscribe

Product

Langflow OSS 1.0.0 Through 1.10.1

1 brief RSS
critical advisory

IBM Langflow OSS Remote Code Execution via Deserialization

IBM Langflow OSS versions 1.0.0 through 1.10.0 contain a critical deserialization vulnerability (CVE-2026-8476) in its disk-based caching mechanism, which uses Python's unsafe `pickle.loads()` function without proper validation, allowing attackers to process malicious pickle payloads and achieve arbitrary code execution with the privileges of the Langflow server process, leading to complete system compromise.

Langflow OSS 1.0.0 +13 remote-code-execution deserialization python langflow web-vulnerability rce authentication-bypass critical-vulnerability +7
1r 5t 7c 1i