Impact

Successful exploitation of these vulnerabilities can lead to full confidentiality and integrity loss for the affected Langflow instance. If exposed to the internet, attackers may target the application to gain unauthorized access to backend workflows or internal services integrated via Langflow. The number of impacted systems is currently unknown, but organizations utilizing Langflow OSS for automated data processing or AI application development are at high risk.

Recommendation

• Audit existing Langflow OSS deployments for exposure to the public internet and restrict access to trusted management networks immediately.
• Monitor application logs for anomalous access patterns, particularly around API endpoints and administrative interfaces, to detect potential unauthorized data access or manipulation.
• Apply security updates as soon as they are published by the Langflow development team.
• Review documentation for configuration hardening to ensure the least privilege is applied to service accounts and integrations managed within Langflow.

Attack Chain

1. An authenticated attacker obtains flow creation privileges within IBM Langflow OSS.
2. The attacker crafts malicious Python code designed for arbitrary execution on the backend.
3. The attacker embeds this malicious Python code into dynamic CodeInput fields of a Langflow component.
4. The Langflow Policies component's ToolGuard integration performs an insufficient validation check, only examining the main component source code and bypassing the allow_custom_components=false control.
5. The malicious code embedded in the unvalidated dynamic fields is persisted within Flow.data when the flow is saved.
6. When a guarded tool within the manipulated flow is subsequently invoked, the ToolGuard runtime executes the malicious Python code server-side.
7. The attacker can further escalate by utilizing the agentic MCP update_flow_component_field tool with attacker-controlled user_id parameters to inject malicious code into other victim users' flows, achieving cross-tenant manipulation.
8. In environments configured with AUTO_LOGIN=true and NEW_USER_IS_ACTIVE=true, the initial authentication requirements for the attacker may be reduced, broadening the attack surface.

Impact

Successful exploitation of CVE-2026-9135 grants authenticated attackers arbitrary Python code execution on the backend systems running IBM Langflow OSS. This can lead to full compromise of the underlying server, data exfiltration, or further lateral movement within the network. The vulnerability's ability to facilitate cross-tenant flow manipulation through the update_flow_component_field tool means that an attacker could inject malicious code into other users' environments, impacting data integrity and confidentiality across the platform. Furthermore, specific misconfigurations can lower authentication barriers, potentially increasing the number of vulnerable instances and the ease of exploitation.

Recommendation

• Immediately update IBM Langflow OSS to a patched version beyond 1.9.2 or apply the provided security patch for CVE-2026-9135.
• Review and ensure that the AUTO_LOGIN and NEW_USER_IS_ACTIVE configurations are set appropriately for your environment to prevent reduced authentication requirements that could facilitate exploitation of CVE-2026-9135.
• Monitor server-side logs on systems running IBM Langflow OSS for unusual process creations or outbound network connections from the Langflow application process, which could indicate arbitrary Python code execution.